Ransomware is the nightmare scenario every business owner has half-heard about: you turn on the computer and a message demands payment to unlock your own files. It's one of the most damaging and common cyber threats facing small businesses today — but it's also largely preventable. Here's how it works and, more importantly, how to keep it out.
What ransomware actually does
Ransomware is malicious software that locks up (encrypts) your files so you can't open them, then demands a ransom — usually in cryptocurrency — for the key to unlock them. Some strains also steal a copy of your data first and threaten to publish it unless you pay. Either way, your business grinds to a halt: no files, no systems, no work.
And paying is no guarantee. Plenty of businesses that pay never get a working key back, and paying marks you as a soft target for next time. Prevention is vastly cheaper and less stressful than dealing with the aftermath.
How it gets in
Ransomware almost always arrives through a few predictable routes: a phishing email with a malicious attachment or link, a weak or stolen password on a remote-access connection, or unpatched software with a known security hole. Notice that all three are things you can defend against — this isn't unstoppable wizardry, it's mostly opportunism.
The layers that keep it out
- Reliable, separate backups — the ultimate safety net. If your files are locked but you have clean, recent backups kept separate from your main systems, you can restore and refuse to pay. This is the single most important defence.
- Email filtering and staff awareness — stops most malicious emails landing, and helps your team avoid the ones that do.
- MFA on everything — multi-factor authentication stops stolen passwords being used to walk straight in.
- Up-to-date software — security updates close the holes ransomware exploits. Unpatched systems are an open door.
- Sensible access limits — if every user can reach everything, so can ransomware. Limiting access contains the damage.
What to do if you're hit
Act fast and stay calm. Disconnect the affected device from the network immediately to stop it spreading. Don't pay anything or delete anything yet. Contact your IT support straight away — the priority is containing it, working out what's affected, and restoring from clean backups. The faster the response, the smaller the damage.
Getting properly protected
The reassuring truth is that the same handful of measures — tested backups, email security, MFA, patching and sensible access — stop the vast majority of ransomware. We build these layers in for North East businesses as part of our cybersecurity work, with backups held on our own private Cramlington servers so a clean copy of your data is always within reach. If you'd like to know where you stand, book a free review.