A company I work with was hit when the employee opened a phishing email supposedly from another employee in the same company. It hit about 50 gb of data on the shared drive. We had Crashplan and restored from a few days previous. I then turned on DKIM and enabled quarantining non DKIM emails via DMARC.
DomainKeys Identified Mail (DKIM) lets an organization take responsibility for a message that is in transit. Domain-based Message Authentication, Reporting and Conformance (DMARC) is a technical specification created by a group of organizations to help reduce the potential for email-based abuse, such as email spoofing and phishing e-mails, by solving some long-standing operational, deployment, and reporting issues related to email authentication protocols
The ten thousand readers of HN who don't know these acronyms can use a search engine to look them up, or someone can ask a question and someone else can answer it and save 9,998 other readers the bother.
1 Google search = 1/35 of a boiled kettle.
So asking the question just saved about 285 boiled kettles of carbon footprint.
And having a flamewar on how people should google things for themselves wasted how many kettles? Anyway, if you don't want to tell people things, then don't tell people things, but going on and on on how OP should just google things themselves, is reaching 4chan levels of elitism. It's a really shitty kind of elitism.