EP291 - The Real Lessons Learned from a £500k MSP Ransomware Attack with Ken Roulston & Ian Luckett

In this episode of The IT Experts Podcast, we share one of the most honest and eye-opening conversations we have ever had about a ransomware attack and the devastating impact it can have on an MSP. Ken Roulston joins me to openly discuss the events that led to a real world cyber incident which ultimately cost more than £500,000, challenged every part of the business, and tested the resilience of the leadership team in ways few business owners ever experience.

This conversation is not designed to create fear. It is designed to create awareness. Every MSP owner believes they have the right security in place, the right backups running and the right processes protecting both their own business and their clients. Ken's experience demonstrates why confidence must always be backed up with verification, discipline, and continual improvement.

Ken shares the full story of how a successful acquisition appeared to strengthen the business before a ransomware attack turned everything upside down. What began as a routine business trip quickly became one of the most stressful weekends of his career. A private data centre belonging to the newly acquired business had been compromised, leaving more than forty client environments inaccessible. As the investigation unfolded, it became clear that the attackers had gained access through one of the least protected customer environments before remaining undetected for several months.

One of the biggest lessons from this ransomware attack is that strong technology alone is never enough. Human error, incomplete backup verification and inconsistent security standards combined to create a perfect opportunity for attackers. The discussion explores how backup systems appeared to be functioning correctly while failing to produce recoverable data when it mattered most. It is a reminder that testing your disaster recovery process is every bit as important as performing the backup itself.

Ken explains the difficult decision to negotiate with the attackers after discovering there was no viable way to restore the systems independently. He openly describes the emotional pressure of balancing legal advice, customer expectations, and the financial impact while attempting to recover critical business systems. It is an extraordinary insight into a situation that many MSP owners hope they will never face, although every provider should prepare for the possibility.

As the recovery began, the challenge shifted from retrieving encrypted information to rebuilding more than forty client environments from the ground up. The team worked around the clock for weeks to restore services, rebuild trust and move customers onto more resilient cloud infrastructure. Despite the enormous disruption, the business retained the majority of its recurring revenue and emerged with valuable lessons that continue to shape how Ken advises MSPs today.

Throughout the episode we explore the practical actions every MSP should take immediately. Ken highlights the importance of enforcing minimum security standards across every client, verifying backups regularly, maintaining isolated recovery environments, and investing in your own cybersecurity with the same commitment you expect from your customers. One of the strongest messages throughout the conversation is that MSPs cannot afford to become complacent. Your clients' security directly affects your own business, making security standards a shared responsibility rather than an optional service.

We also discuss how ransomware attacks continue to evolve as cybercriminals become increasingly sophisticated. With artificial intelligence accelerating both defensive capabilities and cyber threats, MSPs must continually review their security posture, educate their teams, and ensure every client understands the importance of maintaining modern cybersecurity standards. Building resilience is no longer about reacting to incidents. It is about creating systems, habits and leadership that re