No Contract, No Backups, No Warning
In February 2023, Mastagni Holstedt, a 42-attorney law firm in Sacramento, started having connectivity problems. Its longtime IT provider, LanTech LLC, told the firm the issue had been resolved and gave no further information about any underlying cybersecurity risk. Days later, on February 27, the firm suffered a “major outage” that knocked out servers and data access across the network. It was ransomware, deployed by the Black Basta group, and the firm ultimately paid an undisclosed ransom to get back online.
What made the incident worse was what the firm discovered afterward: its data backups had been deleted. According to the lawsuit Mastagni Holstedt later filed against LanTech, its owner Terry Berg, and backup provider Acronis, attackers gained administrator-level access using compromised credentials and wiped out both local and cloud backups before the ransom demand landed — removing the one safety net that should have made the whole event a non-event.
The detail that stands out most to anyone who has ever hired an outside IT company: there was no written contract governing the relationship. LanTech had been providing monitoring, advice, installation, cloud backup, and hardware and software sales to the firm for years, all under an oral agreement. No signed scope of work spelled out what “cybersecurity services” actually meant, what was being monitored, or who was responsible for verifying that backups were intact and isolated from the rest of the network.
Mastagni Holstedt is now suing for more than $1 million, alleging negligence and breach of contract. Acronis has denied responsibility. The case, filed in Sacramento County Superior Court, was still working through pretrial proceedings as of early 2024. Whatever a court ultimately decides about liability, the facts already on the record tell a familiar story: a long, comfortable, low-friction vendor relationship with nothing in writing to confirm the protections everyone assumed were in place.
Why This Matters If You’re Not a Big Company
A 42-lawyer firm is not a Fortune 500 company, and that’s exactly the point. Most small and mid-size businesses don’t have a dedicated IT department reviewing vendor contracts or auditing backup configurations — they have a relationship with an outside provider that started years ago, has never really been revisited, and runs on trust and familiarity rather than documentation. That’s not unusual. It’s also exactly the setup that makes a business unable to answer basic questions after something goes wrong: Were backups actually tested? Were they isolated from the production network, or reachable by anyone who compromised a domain admin account? What was this vendor actually contracted to monitor?
An informal arrangement is often the cheapest option in the short run — no procurement process, no negotiated SLA, no line-item security services to justify. But it’s cheap because nobody is required to verify anything. When a provider’s scope of work exists only in conversation, there’s no paper trail forcing a real conversation about backup testing, credential protections, or incident response — until the business is staring at a ransom note and asking why the backups it thought it had aren’t there.
What Actually Would Have Stopped This
A written services agreement that explicitly names backup testing, credential monitoring (including MFA on privileged accounts), and network isolation for backup storage would have forced the question before an attacker did. Backups that live on the same credentials and network as everything else aren’t really a separate layer of protection — they’re one compromised login away from being deleted along with everything they were supposed to protect. Backups need to be immutable or air-gapped, and someone needs to actually test restoring from them on a schedule, not just confirm a backup job “ran.”
The second piece is accountability that survives a vague status update. When LanTech told the firm the connectivity issue was “resolved” with no further detail, that should have been the moment to ask harder questions, not the moment to move on. A defined relationship — one with a documented scope, regular reporting, and a named point of contact for security specifically — makes it much harder for a real warning sign to get waved off as routine.
Security Checklist for Your Business
Get it in writing. A real services agreement should spell out exactly what’s monitored, who’s responsible for backups, and what “cybersecurity services” actually includes.
Isolate and test backups regularly. Backups reachable from a compromised admin account aren’t a safety net — confirm yours are immutable or air-gapped, and test restoring from them.
Require MFA on every privileged account, especially the ones with the access needed to touch backup systems.
Push past vague reassurances. If your provider says an issue is “resolved” without explaining what happened, ask what caused it and what they checked before moving on.
A handshake IT relationship can run fine for years — right up until the day it can’t answer the one question that matters. MSP Today’s trusted tech partner is JK Computer Solutions. If you want a second set of eyes on your setup, get in touch.
Source: MSSP Alert, “Law Firm Sues MSP Over Black Basta Ransomware Attack”.