Ransomware is malicious software that encrypts a company's files and systems and demands payment for the key, often after first copying data so attackers can threaten to publish it. Small businesses are hit mostly through a few predictable doors: phishing emails, remote access left open with weak passwords, unpatched devices and pirated software. Closing those doors, limiting who has administrator rights and keeping an offline backup prevents most attacks or makes them survivable.
Paying does not guarantee recovery and does not stop stolen data from being misused. The real protection is preparation: knowing what you would do on the morning the screens show a ransom note, before it happens.
How a ransomware attack usually unfolds
Ransomware rarely strikes in a single moment. In a typical case, someone first gets a foothold: an employee opens an attachment, a password to remote access is guessed, or an old firewall with a known flaw is exploited. Then the attacker quietly explores the network, looks for administrator accounts, finds where backups and important files live, and often copies data out.
Only after that preparation, sometimes days or weeks later, is the encryption launched, often at night or during a holiday when nobody is watching. By morning, files have strange extensions, programs fail to open and a note explains how to pay.
This timeline matters for defence. There are several chances to stop the attack: at the first door, while the attacker moves around, and when they try to reach backups. Small businesses that survive well usually blocked one of these steps, even if they did not stop the first one.
It also explains why "we are too small to be a target" is wrong. Many attacks are automated and opportunistic. Scanners look for any open remote access or vulnerable device on the internet, and phishing emails go out in huge volumes. Size does not protect you; open doors attract attackers.
The doors ransomware uses most often
Phishing emails. Attachments pretending to be invoices, shipping notices or tax documents, or links to fake login pages that steal email passwords.
Remote desktop exposed to the internet. A computer or server reachable directly from the internet with a guessable password is one of the most common entry points.
Unpatched firewalls, VPNs and routers. Devices at the edge of the network with known security flaws are actively scanned and exploited. Updates for them matter as much as for computers.
Pirated and cracked software. Cracked programs, activation tools and "free" versions of paid software are a well-known way to deliver malware. Saving on licences can cost the whole business.
Reused or leaked passwords. Staff passwords leaked from other websites are tried against company email and remote access.
Everyday use of administrator accounts. If users browse and open email with administrator rights, any malware they run gets the same power.
Compromised IT providers or remote support tools. Attackers who break into a provider's tools can reach many customers. Ask how your provider secures its access.
USB drives and shared computers. Less common today, but still a route in offices where files move on USB sticks between home and work.
A prevention checklist you can work through this month
None of these steps require large budgets. Work through them in order with whoever manages your IT.
- Turn on two-factor authentication for email and any remote access. This blocks most attacks based on stolen passwords.
- Close remote desktop to the internet. If staff need remote access, use a VPN or a secure remote access service with two-factor authentication instead.
- Update everything, including the network edge. Computers, servers, firewalls, routers, VPN devices and printers. Replace devices the maker no longer updates.
- Remove pirated software. Replace it with licensed or free legitimate alternatives.
- Separate administrator accounts from daily accounts. Staff use standard accounts; admin rights are used only when needed.
- Create an offline or immutable backup and test it. This is the step that decides whether an attack is a disaster or a bad week.
- Install and monitor security software. Modern endpoint protection on every computer, with alerts going to someone who reads them.
- Train staff with real examples. Show them the phishing emails that actually reach your company and agree on how to report suspicious messages.
Keep a short written list of what was done and when. It helps when you review next year, and when you talk to experts after an incident.
Why paying the ransom is not a plan
Some owners assume that if the worst happens, they can simply pay. That assumption is dangerous. Decryption tools supplied by attackers can be slow, buggy or incomplete. Some attackers take the money and disappear. Others return later, knowing the company pays.
Data theft changes the picture further. If files were copied before encryption, paying for a key does nothing to prevent the data being sold or published. Customer and staff data may already be exposed, which brings its own obligations and reputational damage.
There may also be legal and financial issues around payments to criminal groups, which vary by country and change over time. Any business facing that decision should involve the police and qualified legal and security advisers rather than negotiating alone.
The only reliable alternative is to be able to restore without the attackers. That depends on backups they could not reach, and on knowing how to rebuild systems cleanly. Planning that in advance is far cheaper than any ransom.
What to prepare before anything happens
Write a one-page plan. It should say who decides, who to call (your IT provider, your bank if payments may be affected, the police), how to disconnect affected computers from the network, where the offline backups are, and how staff will communicate if email is down.
Keep a printed copy of key phone numbers, because during an attack you may not be able to open files or email. Store the plan and contact list somewhere outside the main systems.
Agree in advance that nobody turns computers back on, deletes files or contacts the attackers without the decision maker's approval. Well-meant actions in the first hour can destroy evidence or spread the infection further.
Run a short tabletop exercise once a year: sit together for thirty minutes, imagine the ransom note appears on Monday morning, and walk through the plan. The gaps you find in that half hour are much cheaper than the ones you find during the real thing.
Frequently asked questions
Can antivirus alone stop ransomware?
It helps, but it is not enough. Attackers often disable security tools after getting in, so two-factor authentication, updates, limited admin rights and offline backups are just as important.
What should I do first if I see a ransom note?
Disconnect affected computers from the network without turning them off if possible, call your IT provider, and report to the police. Do not contact the attackers or delete files before getting expert advice.
Are Mac computers safe from ransomware?
They are targeted less often than Windows computers, but not immune, and shared drives and cloud accounts they connect to can still be affected. Apply the same habits on every system.
Is cyber insurance worth it for a small business?
It can help with recovery costs and expert support, but policies vary widely and often require basic security measures. Read the conditions carefully and ask a qualified insurance adviser.
Why is pirated software such a risk?
Cracks and activation tools need deep access to the computer and come from unknown sources, which makes them an ideal way to hide malware. They also stop receiving security updates.
