One Password, 150 Servers: Lessons from the Peikko Ransomware Attack

This morning I joined Microsoft's Cyber Genius session, where Peikko Group walked through the ransomware attack that hit them at the end of 2024. Peikko is a Finnish, family-owned maker of connection parts for concrete buildings, with about 2,200 people and factories in more than 10 countries.

It was one of the most open incident talks I have seen. Here is what happened, in plain words, and what the rest of us can learn from it.

How it started#

On Christmas Eve 2024, someone logged into Peikko's VPN with a real employee account. They didn't break down the door. They walked in with a key.

How they got that key has not been made public. The usual routes are malware that steals saved passwords, logins bought from criminals who sell access, password guessing, or holes in unpatched VPN devices. In every case, multi-factor authentication (MFA) turns a stolen password alone into a dead end.

The timeline (UTC)#

When	What the attackers did
24 Dec, 16:52	Logged in through the VPN with a valid account
26 Dec, 13:00	Gained higher privileges on a server
26 Dec, 13:07	Mapped the network and pulled directory data
27 Dec, 19:08	Hopped between machines with Remote Desktop
27 Dec, 19:32	Installed a Cloudflared tunnel as a hidden back door
27 Dec, 20:55	Deleted Windows shadow copies (built-in restore points)
27 Dec, 22:08	Started encrypting servers
27 Dec, 22:30	The 24/7 security team detected it and escalated
28 Dec, 00:21	Data was still being copied out

Two things stand out:

• Detection took 22 minutes after the encryption started. That is fast.

• The attackers had been inside for about three days before that, over the holidays, unnoticed. The gap between getting in and getting caught is called dwell time, and shrinking it is most of the game.

The damage#

• The attackers took over Active Directory, the system that controls every Windows login and device.

• About 150 of 200 servers were hit, most of them encrypted. Only about 60 of 1,300 PCs were encrypted. The attackers went for the servers, because that is where the business runs.

• Data was stolen from file shares in four countries, including personal data. Peikko notified the data protection authorities, as GDPR requires.

• Ransomware trackers list the Akira group as behind it. Peikko's view was that who did it mattered less than how they did it.

What saved them#

• Cloud services kept running. Email and their cloud ERP stayed up, so people could still work and talk.

• A newer backup platform the attackers could not reach made fast recovery possible. The old local backups suffered the most.

• An older on-site system had to be restored from a backup taken on 21 December, so about six days of work had to be redone.

• They rebuilt carefully, not quickly. Restoring too fast risks bringing the attacker's back door back with you. Most operations were close to normal by 9 January.

Leading through the crisis#

The part I liked most was not technical:

• One clear owner for decisions, and a fixed daily check-in rhythm.

• Keep the technical team focused and away from constant "is it fixed yet?" questions.

• Priorities in order: safety, then continuity, then recovery.

• Go public early and honestly. Peikko spoke publicly on day 3, saying both what they knew and what they didn't, through a series of numbered updates.

• Tell everyone directly: staff, customers, authorities, the board, partners, and even competitors, who might be targeted by the same people.

Their closing line summed it up: Resilience = People + Preparedness + Purpose.

A checklist for small teams, builders and relay operators#

You don't need a big security team to block most of this chain.

Lock the front door

• Turn on MFA everywhere: email, VPN, cloud, hosting, domain registrar, GitHub.

• Patch anything facing the internet (VPNs, routers, servers) quickly.

• Never leave Remote Desktop or SSH with passwords open to the internet. Use keys, a VPN with MFA, or both.

Make the back door hard to hide

• Watch for logins from new countries, odd hours or new devices.

• Watch for new services, tunnels or scheduled tasks you didn't create.

• Use separate admin accounts, and give people only the access they need.

Make sure you can recover

• Keep at least one backup that an attacker with your passwords cannot delete (offline or immutable).

• Actually test restoring it. A backup you have never restored is just a hope.

• Know how much data you can afford to lose, and back up at least that often.

Have a plan before you need it

• Write a one-page "if I get hacked" plan: what to lock first, who to call, where the backups are.

• In the EU, personal data breaches must be reported to your data protection authority within 72 hours. In Denmark that is Datatilsynet.

• Decide now how you will tell your users. Short, honest, numbered updates work.

For Nostr folks specifically

• Your nsec is your identity. Keep it out of plain-text files and servers, and consider a remote signer.

• Relay operators: back up your relay database somewhere separate, protect server SSH with keys, and put MFA on your hosting and domain accounts.

• If your relay goes down or gets compromised, post a status note. Silence breeds rumours.

The one-line takeaway#

A single password without MFA opened the door to a company-wide crisis. The attackers were patient and organised. Peikko recovered because they had backups the attackers could not touch, clear leadership, and the courage to communicate openly.

Prepare before you need to.

Source: Microsoft Cyber Genius, "The Future of AI Powered Security" (30 September 2026), with Peikko sharing their own incident. Figures are as presented in the session.