A bookkeeper opens an invoice attachment on a Tuesday morning. It looks like the twenty others she has opened this month. By lunchtime, the shared drive is full of files renamed with strange extensions, a note is sitting on three screens demanding payment in cryptocurrency, and nobody can access the order system. No hacker in a hoodie, no dramatic alarm — just an ordinary email and an ordinary working day. What decides how badly that afternoon goes is not your budget. It is a handful of decisions made weeks earlier.
What ransomware actually does
The name suggests a single trick: your files get locked, you pay, you get a key. That is now the simplified version. Most serious ransomware families work in three stages. They get in. They spend days or weeks quietly mapping your network, collecting passwords, and copying out customer lists, contracts and payroll data. Then they encrypt everything they can reach and threaten to publish what they stole if you refuse to pay.
That last part matters. Restoring from a backup solves the encryption but not the blackmail, because the stolen data is still in someone else's hands. It also means the damage is rarely limited to one computer. Shared drives, connected backup devices, and any cloud account the infected machine was signed into are all fair game.
The doors attackers actually use
Small businesses are rarely targeted for who they are. They are found by automated scanning that sweeps the internet for known weaknesses, then exploited because nobody got around to fixing them. The most common ways in:
- Phishing. A fake delivery notice, an unpaid invoice, a "shared document" link. The attachment or the login page does the work.
- Weak or reused credentials. Remote desktop access exposed to the internet with a password that appears on a breach list is an open door.
- Unpatched software. A router, VPN appliance or server with a known flaw that has been public for months.
- Connected third parties. A contractor's laptop, a supplier's file transfer, or your IT provider's tools can carry the infection straight past your defences.
Notice the pattern: every one of these is either a human decision or a maintenance task that slipped. That is frustrating, but it is also encouraging, because both can be improved without a large budget.
What an attack really costs
Owners tend to focus on the ransom figure. In practice that is often the smallest line. The bigger costs are the days your team cannot work, orders you cannot fulfil, wages still being paid, the specialist help to clean the systems, and the slow bleed of customers who shop elsewhere while you recover. Add the hours your own staff spend rebuilding machines and answering questions, and the reputational hit if personal data was taken.
A useful exercise: estimate what one day of total downtime costs your business. That number turns vague worry into a budget line, and it usually makes a few thousand pounds of preventive work look cheap.
On paying: a payment buys no guarantee of a working decryption key, funds the next attack, and in some jurisdictions raises legal and sanctions questions. Treat any decision to pay as one to take with a lawyer and your insurer, not alone at 2am.
Backups: three rules that matter
A backup strategy is only as strong as its weakest habit. Three rules cover most of it:
- Keep one copy out of reach. Offline or immutable — a drive that is disconnected when not in use, or cloud storage with versioning and object lock enabled. If the backup is mounted on the network, ransomware will encrypt it too.
- Follow the 3-2-1 idea. Three copies of important data, on two different types of media, with one kept offsite. It is an old rule and it still works.
- Test a restore. A backup you have never restored is a hope, not a backup. Restore a single folder every month and a full system every quarter, and time how long it takes.
One more thing: separate the accounts. If the same administrator login can reach your servers and delete your backups, an attacker who steals it can do both.
Training staff without boring them
An annual hour-long slideshow changes nothing. Short, frequent, specific conversations do. Ten minutes a month, covering one pattern at a time, beats a compliance tick-box every time.
Teach the signals: unexpected attachments, sudden urgency, payment details that changed, a domain that is almost right but not quite, and multi-factor prompts nobody triggered. Then teach the single most useful habit — verify out of band. If an email asks you to pay a supplier or reset a password, call the person on a number you already have.
Make reporting easy and blame-free. The employee who clicks a bad link and reports it within two minutes has just saved the company; the one who stays quiet for two days because they fear a telling-off may cost you everything. Run occasional simulated phishing tests, but use the results to teach, never to shame.
If it happens anyway
Speed matters more than pride. Disconnect the affected machine from the network — unplug the cable, switch off Wi-Fi — but do not wipe it or power it down if you can avoid it; it may hold useful evidence. Call your IT support or an incident response firm immediately, and warn colleagues to stop using shared drives. Notify your insurer early and check what your policy requires you to do. Get legal advice before you contact anyone outside the company, because notification duties may apply if personal data was taken. Attacks often land overnight and are discovered when staff arrive, so have the phone numbers ready before you need them.
A realistic plan for the next thirty days
You do not need a security department. You need five things done properly:
- Turn on multi-factor authentication for email and remote access first, then everywhere else.
- Confirm you have one offline backup, and restore a single file from it this week to prove it works.
- Switch on automatic updates and book a date to replace anything no longer supported.
- Spend fifteen minutes with the team on out-of-band verification and how to report a mistake.
- Write a one-page plan: who to call, in what order, and where the backups live.
None of this is exciting, and none of it guarantees you will never be hit. But it moves you from an easy target to an inconvenient one — and inconvenient targets are usually the ones attackers skip in favour of the business down the road.
Photo: StockSnap / Pixabay
