A Use Case from Loginform’s Practice

A ransomware attack is not an IT inconvenience. It is a business crisis.

When a company’s systems shut down, access is lost not only to files, reports, or historical data. Invoicing, inventory management, financial administration, customer service, and ultimately revenue generation itself may come to a halt.

At Loginform, we have encountered several situations where companies turned to us after a ransomware attack with one urgent question:

“How can we start invoicing again as quickly as possible?”

The answer: with the right methodology, an experienced Business Central team, and highly focused decisions, surprisingly quickly.

Thanks to our rapid methodology, the first invoice can be issued from the newly implemented Microsoft Dynamics 365 Business Central system as early as five business days after the project starts.

---

What Happens After a Ransomware Attack?

Such an attack often does not begin with a spectacular explosion. The malware works silently in the background: it maps the network, searches for accessible drives, servers, and backups, then starts encrypting whatever it can reach.

The biggest problem is often not whether there is a backup, but whether the backup is truly protected.

If the backup is accessible from the same network, if permission rules are inadequate, or if too many users have overly broad access, the ransomware may even encrypt the backups. In such cases, the company suddenly realizes that the safety net it trusted is not usable — or no longer exists at all.

The situation is made even more difficult by the shock effect. Management must make several decisions at once: whether to pay, wait, involve an external data recovery company, or start building a new operational foundation.

Meanwhile, the days pass. Customers are waiting. Invoices are not being sent. Revenue is not coming in.

---

Prevention or Emergency Recovery?

The best way to handle ransomware is, of course, to prevent the attack from happening in the first place. At the end of this article, we have therefore collected the basic steps that can significantly reduce the risk.

But if the problem has already occurred, the most important question quickly changes:

How can the company start invoicing again?

---

The Most Important Question: What Is Needed to Start Invoicing Again?

Under normal circumstances, a complete ERP implementation is a comprehensive process that may take several months. Financial, commercial, logistics, warehouse, manufacturing, and reporting requirements must be assessed. Permissions, integrations, and custom developments must be designed, and processes must be tested.

In an emergency after a ransomware attack, however, the goal is different.

The question is not whether everything works perfectly on day one.

The question is:

Can the first invoice be issued?

To achieve this, the emergency Business Central methodology used by Loginform takes a highly focused approach to go-live. In the first phase, only what is absolutely necessary for invoicing is included:

• customer master data;
• item master data;
• basic invoicing settings;
• the minimum required financial parameters;
• NAV Online Invoice connection;
• user access required for operation.

Warehouse, purchasing, inventory, reporting, and other processes can then be rebuilt gradually. This is what we can call an emergency implementation, or an emergency ERP launch.

---

“They Could Hardly Believe It Was Possible to Start This Quickly”

According to Zsolt Mógor, Head of Loginform’s M365 Business Central division, the most important factors in these situations are decision-making ability and prioritization.

The goal is not to rebuild every previous operational detail in the first week.

The goal is for the company not to be left without a revenue-generating process.

In practice, this meant that from the available data — such as management reports, Excel backups, previous exports, and email attachments — enough basic data could be reconstructed to restart invoicing in Business Central.

In one case, even the IT manager found it hard to believe that the first invoice could be issued from the new system so quickly.

But that is exactly what happened.

---

Why Is Cloud-Based Business Central Especially Important?

One of the key lessons of ransomware attacks is that the security of self-hosted, on-premise systems depends on many factors.

• Are the servers updated on time?
• Are permissions properly managed?
• Are backups separated?
• Is virus protection up to date?
• Is there enough IT resource?
• Does the recovery plan actually work?

Many companies have answers to these questions on paper. In a crisis, however, it may turn out that in practice the situation is not so clear.

Cloud-based Microsoft Dynamics 365 Business Central, by contrast, is built on an infrastructure where a significant share of security, operation, update, and availability tasks is not carried by the company’s own internal IT team alone.

This does not mean that conscious security practices, permission management, or user discipline are no longer needed. But it does mean that the company is not trying to protect its business continuity entirely on its own.

In addition, on-premise systems often only seem cheaper at first glance. Once servers, licenses, electricity, operation, system administration capacity, updates, backup solutions, monitoring, and the business risk of downtime are included, the total cost of ownership may show a very different picture.

---

The Weakest Link Is Often Not the Technology

With ransomware, the weakest point is often the human factor.

• One wrong click.
• One overly broad permission.
• One unpatched computer.
• One neglected server.
• One backup that technically exists but is not protected.
• One oversight by an overloaded operations team.

Each of these represents a risk on its own. Together, they can become a serious business continuity problem.

That is why moving to the cloud is not only a technological decision, but also a management responsibility. It is about how much the company wants to reduce the chance that a local infrastructure problem turns into a complete operational shutdown.

---

What Can Loginform Add to This?

Loginform’s strength is not only that we know Business Central, but that we also understand company operations, financial and accounting logic, and business priorities.

This is especially important in a crisis.

In such situations, there is no time for long theoretical debates. It must be clear which process is critical, what can wait, what data can be used, what must be configured immediately, and how the system can be launched in a way that enables the company to generate revenue again.

A rapid Business Central launch after ransomware requires exactly this combination: speed, expertise, business thinking, and human presence.

---

Lessons for Business Leaders

A company should not start preparing for a ransomware attack only after it has already happened.

The most important management questions are:

• Do we know what we would restore from?
• Are our backups truly protected?
• How quickly could we start invoicing again?
• What would happen if our current ERP system were unavailable for days or weeks?
• Do we have a decision-making scenario for a crisis?
• Is it worth postponing the move to cloud-based Business Central any longer?

Based on Loginform’s experience, there can be a fast way out even from a serious situation — if management is able to make decisions, the goal is clear, and the implementation partner knows exactly what needs to be made operational first.

---

Switching from Navision or On-Premise ERP to Business Central?

If your company still uses an old Navision, Dynamics NAV, or self-hosted ERP system, it is worth considering the move to cloud-based Business Central in time.

To support this decision, we have prepared a comprehensive material for company leaders and professional decision-makers:

Navision → Business Central Migration Guide 2026 – Free Download

Decision Guide for Company Leaders and Professional Decision-Makers

Download:
https://loginform.hu/navision-business-central-migracios-utmutato-2026-ingyenes-letoltes/

---

How Can Ransomware Be Avoided?

Protection against ransomware does not depend on a single piece of software. It depends much more on how consciously the company manages IT security, permissions, backups, and user-related risks.

The most important actions:

1. Update regularly

Operating systems, servers, antivirus solutions, and business applications must be kept continuously up to date. Postponed updates can create serious security gaps.

2. Limit permissions

Every user should only have access to what they truly need. Overly broad permissions can accelerate the spread of damage in the event of an attack.

3. Protect backups separately

It is not enough to “have a backup.” Backups should be separated, tested regularly, and not directly accessible from the same network that could be affected by an attack.

4. Train employees

One wrong click may be enough. Employees need to know how to recognize suspicious emails, attachments, links, or unexpected login requests.

5. Use multi-factor authentication

A password alone is no longer enough today. Multi-factor authentication significantly reduces the chance that unauthorized users can access systems with a stolen password.

6. Have a business continuity plan

It must be clear in advance what happens in an emergency: who makes decisions, who must be notified, where recovery starts from, and which business process must be restarted first.

7. Reconsider the risks of on-premise operation

Self-hosted operation may appear more controlled at first, but it also creates a significant burden in terms of security, updates, and resources. In many cases, a cloud-based Business Central environment can provide a safer, more up-to-date, and more resilient operational foundation.

---

Loginform Tip

Do not only ask:

“Do we have a backup?”

Also ask:

“How quickly could we start invoicing again if all our systems stopped tomorrow morning?”