It happened when almost no one was watching.
On Christmas Day 2019, National TV Sales & Rental had closed its stores for the holiday, and Owner Aaron Windsor was out of town with his family.
The next day, he got the call: every computer in the company was locked.
About 130 computers were inaccessible, and the attackers were demanding a ransom before they would provide the keys to unlock them.
As part of APRO’s Cyber Scares: Real Stories from Rent-to-Own series for Cybersecurity Awareness Month, APRO is revisiting the ransomware attack shared by Windsor and the lessons it provided about something that matters just as much as trying to prevent a cyberattack: being prepared to keep moving when one happens.
An Attack Months in the Making
The ransomware had not arrived on Christmas Day.
The investigation ultimately traced the intrusion back to an email on Windsor’s work computer months earlier. The message appeared legitimate and contained an invoice from a vendor the company had done business with.
When the invoice was opened, Windsor said it led to an unsecured website that allowed malicious software onto the computer.
By the time investigators discovered it, the email was approximately seven months old. Windsor said the malicious software had apparently been sitting on his computer for more than six months before the attackers activated it.
When they finally did, the reach was extensive.
Through remote-access software on Windsor’s computer, the attackers were able to access systems across the company, including store servers, corporate servers, camera servers, and workstations.
Approximately 130 computers were affected.
The ransom demand was approximately $1.4 million.
When the Backups Aren’t Enough
National TV Sales & Rental had backups.
The problem was that the backups had also been affected.
Windsor said the company performed daily backups, but because the malicious software had remained undetected for months, those backups had repeatedly preserved the compromised environment along with the company’s data.
By the time the ransomware was activated, Windsor said the backups covering the previous six months were corrupted.
That experience illustrates an important distinction: having backups is not the same as having recoverable backups.
The Cybersecurity and Infrastructure Security Agency (CISA) recommends organizations maintain offline, encrypted backups of critical data and regularly test them. The agency also recommends keeping backups separated from primary networks because some ransomware is designed to locate and compromise accessible backups.
CISA also recommends developing and practicing a cyber incident-response plan so organizations know how they will respond and communicate if an attack occurs.
For National TV Sales & Rental, recovery required outside help. Windsor said the company brought in forensic investigators experienced in ransomware incidents, along with attorneys and its insurance provider. The forensic team investigated the company’s systems, evaluated whether data had been taken, and handled negotiations with the attackers.
The incident stretched from Christmas Day until about January 10 before the company’s systems were fully unlocked.
The Cost Went Far Beyond the Ransom
The ransom itself was only one piece of the financial impact.
Windsor estimated that between the ransom payment, attorneys, forensic work, and lost business during the disruption, the incident ultimately cost National TV Sales & Rental just under $4 million.
The experience also prompted the company to change how it approached cybersecurity.
Windsor said National TV Sales & Rental invested in around-the-clock monitoring, with software and protections being continually updated as new threats emerged.
Keeping software current is also one of CISA’s core Secure Our World cybersecurity practices. Updates often address vulnerabilities that attackers can exploit, and CISA recommends installing updates promptly and enabling automatic updates when possible.
But technology was only one lesson from Windsor’s experience.
The attack also exposed an unexpected weakness in the company’s cyber insurance coverage.
Know What Your Cyber Insurance Actually Covers
Windsor believed National TV Sales & Rental had a $30,000 cyber insurance policy per location.
After the attack, he learned the policy provided $30,000 in coverage total.
For an incident affecting approximately 130 computers across the company, that difference was substantial.
His experience offers an important reminder for businesses to understand their coverage before they need to use it.
Policies can differ considerably, and businesses should work with their insurance professionals and appropriate advisors to understand matters such as coverage limits, exclusions, reporting requirements, response services, and any cybersecurity practices required under the policy.
Just as importantly, businesses should know who to call when an incident happens.
Prepare Before the Screen Goes Dark
For rent-to-own businesses, Windsor’s story offers several practical questions worth answering before a cyber incident occurs:
- Are critical systems and software kept current? Install security updates promptly and use automatic updates where appropriate.
- Could your backups survive an attack on your primary network? Maintain protected backups and test whether they can actually be restored.
- Which systems are essential to keeping the business operating? Know which applications, servers, records, and processes must be restored first.
- Who gets the first phone call? Identify internal leaders, IT support, cybersecurity specialists, insurance contacts, legal counsel, and other resources before an emergency.
- Do you have an incident-response plan? Document responsibilities and procedures rather than trying to build the plan while systems are down.
- Have you practiced the plan? Training and exercises can reveal gaps before a real incident does.
- Do you understand your cyber insurance? Review what the policy covers, its limits, and what it requires from the business before and after an incident.
CISA specifically recommends offline and protected backups, incident-response planning, software patching, and identifying response procedures as part of ransomware preparedness.
This Week’s Cyber Habit: Prepare for the Incident You Hope Never Happens
Windsor’s story is a reminder that cybersecurity is not solely about stopping every attack.
It is also about being ready to respond when prevention fails.
National TV Sales & Rental had backups, insurance, and IT systems in place before Christmas 2019. The ransomware attack revealed where those protections worked, where they did not, and what needed to change afterward.
Preparation means knowing which systems matter most, having recoverable backups, establishing an incident-response plan, keeping software current, understanding your insurance coverage, and making sure employees know what to do when something goes wrong.
The worst time to figure out those answers is when 130 computer screens are already locked.
Watch the Full Story and Keep Learning
Hear the full Christmas Day Surprise story directly from Aaron Windsor, Owner of National TV Sales & Rental, as he recounts how a ransomware attack spread across the company, what recovery required, and what the experience taught him about cybersecurity and cyber insurance.
Then continue the conversation with APRO’s Cyber Insurance Demystified: What You Need Before the Breach on October 28, 2026, from 10–11 AM CT. The webinar will explore what cyber insurance covers and does not cover, changing underwriting expectations, and the questions businesses should consider before an incident occurs.
About National TV Sales & Rental
National TV Sales & Rental is a locally owned and operated rent-to-own company serving communities throughout Missouri. Founded in 1986, the company offers furniture, appliances, electronics, mattresses, computers, and other home essentials through flexible weekly, biweekly, and monthly rental-purchase options. National TV Sales & Rental has been an APRO member since 1998.
