Your phone buzzes at 6:40 on a Tuesday morning. It's your operations manager. The shared drive is gone. Every folder, every invoice, every client file — replaced by a single text file with an extension you've never seen before. The file says you have 72 hours to send a payment in Bitcoin, or the decryption key disappears forever.
You've heard about ransomware. You probably think you'd never fall for it. That's what my client told me too, two weeks before a ransomware attack locked down nine years of accounting records and cost him eleven days of lost business.
So let's fix that. This isn't a scare piece. It's a practical walkthrough of what ransomware actually is, how attackers get in, and — most importantly — what you can do starting today to make your business a boring target that criminals skip over.
Key takeaways
- Ransomware encrypts your files and demands payment for the key. Modern variants also steal your data first, so paying doesn't guarantee silence.
- Most infections start with a phishing email, an unpatched service exposed to the internet, or stolen credentials — not with some exotic hacker trick.
- Offline or immutable backups are the single most effective recovery tool you can invest in.
- Paying the ransom is a gamble. Roughly a third of victims who pay never get a fully working key.
- A tested incident response plan beats a clever one you've never rehearsed.
Ransomware explained: what it actually is and what it isn't
Here's the thing most articles dancing around the topic don't say clearly: ransomware is not a virus that "spreads" like a cold. It's a business model. Someone builds or buys the tooling, rents it out, and takes a cut of the payment. The criminal doesn't need to be technical. They need a target.
That reframing matters, because it changes what you're defending against. You're not fighting a genius hacker in a basement. You're competing against a supply chain that sells access to your network for a few hundred dollars on a forum you'll never visit.
The two types you need to know
Encrypting ransomware is the classic: your files get scrambled, and you get a note demanding payment. It's loud, obvious, and immediate.
Double-extortion ransomware is the version that wrecked my client's quarter. Attackers copy your sensitive data before encrypting anything, then threaten to publish it on a leak site if you don't pay. The encryption is almost a side effect. The real leverage is embarrassment, regulatory fines, and clients walking away.
There's a third pattern creeping up too: attackers who skip encryption entirely and just threaten to leak stolen data. Why bother locking files if you can scare a company into paying with a screenshot of its HR database?
How the infection actually happens
Forget the Hollywood version. In the incidents I've helped clean up, the entry points almost always look the same:
- A finance employee opens an invoice attachment that looks legitimate — same vendor, same formatting, tiny detail wrong
- A remote desktop service exposed to the internet with a weak password and no multi-factor authentication
- A VPN appliance the IT team forgot to patch despite a warning banner for weeks
- Credentials reused from an old breach, tested against your login page almost automatically
Notice what's missing from that list. Zero zero-day exploits. Zero custom malware. Just sloppy corners that every busy team cuts.
How to prevent ransomware without rebuilding your entire IT department
You don't need a security operations center to make yourself a hard target. You need four or five things done consistently, and honestly, consistency is where most organizations fail — not sophistication.
Build backups that survive an attack
Every "ransomware prevention checklist" starts here because it's the one thing that turns a catastrophe into an inconvenience. But not all backups count.
A backup that's connected to your network when the attack hits is not a backup. Attackers know to look for it, and they'll encrypt it right alongside your production data. I watched this happen on a project three years ago: the team was proud of their nightly backup, and it was fully encrypted by 7 a.m. along with everything else.
What actually works:
- Offline copies — physically disconnected from the network, rotated on a schedule
- Immutable storage — cloud or on-premise buckets that refuse deletion or modification for a defined retention window
- Tested restores — a backup you've never restored is a hope, not a plan
On a mid-sized network, moving from network-attached backups to immutable cloud storage cost roughly the price of a decent laptop per year. That's what recovery actually looks like when you don't pay it in a panic.
Patch what the internet can reach
Prioritize by exposure, not by severity score. A high-severity flaw on an internal tool nobody accesses is far less urgent than a medium-severity flaw in a service that's exposed to the internet and handling authentication.
Make a list. Everything with a public IP address. Patch that list first, every time. This one habit defeats the most common entry point I keep seeing.
Turn on multi-factor authentication everywhere it matters
Email, remote access, admin consoles, financial systems, cloud infrastructure. Not SMS if you can avoid it — app-based or hardware keys. It doesn't make you invincible, but it turns a ten-minute break-in into a problem the attacker probably abandons.
Train people on the one thing that matters
You can run annual awareness courses and still get phished. The lesson that sticks is narrower: teach your team to slow down before clicking anything that creates urgency — an overdue invoice, a password reset, a delivery notice, a message from the boss asking for a "quick favor."
Urgency is the tell. Attackers manufacture it because it works. Tell your people that if a message makes them feel rushed, that's the moment to stop and verify out-of-band.
A prevention checklist you can actually finish
I've seen 40-page frameworks that no small team will ever implement. Here's a compressed version that covers the highest-impact items. Print it, tick it, update it once a month.
| Area | Minimum viable action | Time to set up | Impact |
|---|---|---|---|
| Backups | Immutable copy + one offline copy, restores tested quarterly | 1–2 days | Very high |
| Authentication | MFA on email, VPN, and admin accounts | A few hours | Very high |
| Patching | Internet-facing systems patched within 7 days of a critical release | Ongoing | High |
| Endpoint protection | Modern EDR on every workstation and server | 1 day | Medium–high |
| Network segmentation | Separate guest, admin, and production networks | 2–5 days | Medium |
| Training | Short quarterly phishing drills with feedback | 2 hours per quarter | Medium |
| Incident plan | One page: who calls whom, what gets isolated first | Half a day | High when it matters |
If you only do three of these this quarter, pick backups, MFA, and patching your exposed services. That combination blocks the majority of what I've seen in the wild.
How to recover from a ransomware attack: the first 48 hours
When the attack is live, panic is your enemy. The actions in the first two hours matter more than anything you do in the following two weeks. Here's the sequence I walk clients through.
Step 1: disconnect, do not shut down
Pull the network cable, disable Wi-Fi, isolate affected systems. Do not power them off. Memory contains evidence — running processes, encryption keys in some cases, and logs that will tell you what happened. Shutting down can destroy all of it.
Step 2: find the scope
Which systems are encrypted? Which are still clean? Which accounts were compromised? Attackers often sit inside a network for days before triggering encryption. Understanding how they dwelled tells you whether the cleanup is done or whether you're about to be hit again.
Step 3: restore from the cleanest available backup
Verify the backup predates the intrusion, not just the encryption event. Restoring a backup taken during the attacker's dwell time means reinfecting yourself. Check file timestamps, look for anomalies.
If you don't have a clean backup, this is where decisions get ugly. Paying is legally and ethically complicated, and the recovery rate is far from guaranteed. Many who pay receive a partially working key, or nothing at all, and become repeat targets because they've proven they'll pay.
Step 4: notify
Depending on your jurisdiction and industry, you may be legally required to notify regulators, affected individuals, or law enforcement within a specific window. Engage legal counsel early — this is not something to improvise once you're exhausted from 30 hours of cleanup.
Step 5: review and harden
Once systems are back, ask the uncomfortable question: how did they get in? Until you have an answer, you're still exposed. Every ransomware incident I've worked on had a fixable root cause — and it wasn't exotic.
Should you pay the ransom?
Short answer: no, if you have any other option. Longer answer: sometimes organizations have no other option, and that's a position you want to avoid through preparation, not through a decision made at 2 a.m.
Three reasons paying is a bad bet:
- You have no guarantee of a working decryption key, and no recourse if the attacker disappears
- Paying signals you're a profitable target — many victims get hit again within a year
- Depending on where you operate, paying may violate sanctions rules if the attacker is linked to a sanctioned group
The organizations that avoid this dilemma altogether are almost never the ones with the biggest security budgets. They're the ones with tested backups.
The bottom line
Ransomware isn't a mysterious force of nature. It's an economic decision on both sides — attackers weigh the effort against the payoff, and you control the effort. Every immutable backup, every MFA prompt, every patched service pushes the math in your favor.
The companies that get hit hardest are rarely the ones with no defenses. They're the ones with defenses that were never tested. A backup nobody restored. An incident plan nobody rehearsed. A patch window that slipped for three months because everyone was busy.
So pick one thing this week. Test a restore. Turn on MFA for remote access. Call your team together and walk through what happens if the drive disappears tomorrow morning. Because the honest truth is that the question isn't whether an attacker will knock. It's whether they'll find a door you forgot to lock.
