Ransomware is criminal software that locks up your files and systems until you pay. Today's attacks usually go further: criminals steal your data first, then threaten to publish it if you don't pay. For most organizations, it's the cyber threat most likely to stop the business in its tracks.
How attacks usually start
Ransomware rarely arrives out of nowhere. Most attacks begin with one of a few familiar weaknesses:
- A stolen or guessed password, especially for remote access or email without multi-factor authentication.
- A phishing email that tricks someone into opening a malicious file or entering their password.
- An unpatched system facing the internet, such as a VPN, firewall or email server.
Once inside, attackers typically spend time quietly exploring, stealing data and disabling backups before they launch the encryption — often at night or over a weekend.
What it really costs
The ransom is only part of the bill. Downtime, lost orders, overtime, specialist investigators, legal advice, customer notifications and damage to your reputation often cost more. And paying doesn't guarantee you'll get your systems back or that stolen data will be deleted.
Decisions to make before an attack
The worst time to make big decisions is in the middle of a crisis. Agree on these now:
- Who's in charge? Name the executive who makes the final calls, with a backup.
- What's our position on paying? Any payment decision needs legal advice — including whether a payment could breach sanctions laws — and your insurer's involvement.
- Who do we call? Keep contact details for your IT lead, an incident response firm, your insurer and legal counsel somewhere that doesn't depend on your own systems.
- What do we tell people? Prepare a simple plan for informing staff, customers and, where required, regulators.
The protections that matter most
- Multi-factor authentication on email, remote access and administrator accounts.
- Backups that attackers can't delete or change, tested regularly — see our backup and recovery service.
- Prompt patching of internet-facing systems.
- 24/7 monitoring, so intruders are caught before they launch the attack.
- A rehearsed incident response plan.
If it happens
Disconnect affected devices from the network but don't switch them off, preserve evidence, switch to a trusted way of communicating, and call for expert help. Our first-hour guide walks through each step.
Key takeaways
- Ransomware is a business continuity problem, not just an IT problem.
- Most attacks exploit basic, fixable weaknesses.
- Decide who's in charge — and your position on paying — before you need to.