Follow the trail from phishing email to ransomware attempt, protect backups, and fully contain the incident.