From the CERT NZ 2019 Q2 report:

"The IT provider investigated and identified that the PDF attachment was a ransomware file that had infected the computer when it had been clicked on. The files had been encrypted with Locky ransomware and unfortunately couldn’t be recovered. The gym had been in business for ten years, and had not backed up or stored any data, so as a result client records and fitness programmes were lost. "

What IT provider would not recommend backup? I hope this company sued the provider.