Once I had to restore an entire organization from shadow copies because the IT director didn’t believe in off-site backups or using endpoint protection. The whole network got a ransomware that included the backups, but did not include the shadow copies on the main file server.

At least I got to help them build a disaster recovery procedure, and pick out a new EDR.