It started with a phone call.

One afternoon I picked up a referral call. The founder of a small company — call them Company B — was on the line, and his voice was tight. Their whole service had been wiped overnight. Ransomware.

Company B ran a gym membership and community platform: gyms checked members in, members logged workouts and joined contests inside the app. It was a hybrid app — native shell with a WebView — and the backend ran on PHP/Laravel. They were on shared web hosting, and an attacker rode a vulnerability in that hosting straight into their directory and encrypted everything. Source code, uploads, config. All of it locked.

And the service was live. Gyms depended on it daily. Every hour it stayed down, real businesses couldn't operate.

I took the job — on the condition that I'd work it solo.