Ransomware: how attacks work and how to manage the risk
Ransomware is the cyber attack most likely to stop a small business trading for days or weeks. This guide explains how an attack actually unfolds, how to score your own exposure honestly, which controls make a real difference, and what to think about before anyone says the word “pay”.
Ransomware is malicious software that encrypts your files and systems and demands payment for the key — and in most modern attacks, the criminals also steal data first and threaten to publish it. Attackers usually get in through weak remote access, unpatched internet-facing systems or phishing. You reduce the risk with multi-factor authentication, fast patching, limited admin rights, endpoint detection and backups that the attacker cannot reach. Assess it as a scenario in your risk register, and judge impact by how long the business can survive without its systems.
Put this into a living risk registerRisk Samurai gives you a ready-made register: score risks on your own scales, assign owners and track actions, with no spreadsheet to maintain.
Get early accessWhat is ransomware?
Ransomware is a type of malware that makes data or systems unusable — usually by encrypting them — and then demands a ransom, almost always in cryptocurrency, for restoring access. Early ransomware spread indiscriminately and locked individual PCs. Today’s attacks are mostly run by organised groups who break into a network, spend time learning it, and then encrypt servers, backups and laptops in one go, often overnight or at a weekend when nobody is watching.
Many groups operate as “ransomware as a service”: developers build and maintain the malware and the leak sites, and affiliates carry out the intrusions in exchange for a share of the proceeds. Some affiliates buy their way in from “initial access brokers” who sell stolen logins or footholds in company networks. The practical consequence for a small business is that you are not targeted because you are interesting; you are targeted because a door was open and someone found it with an automated scan or a purchased password.
Ransomware is one scenario within your wider cyber risk. If you have not yet mapped your assets and threats, start with a cybersecurity risk assessment and come back here to go deep on this one.
Types of ransomware
Ransomware is a type of malware, and “ransomware” covers several different tactics. Knowing which one you face changes what your backups can and cannot fix:
| Type | How it works | What backups solve |
|---|---|---|
| Crypto ransomware | Encrypts files, servers and sometimes backups; demands payment for the key | Availability — if backups are intact and restores are tested |
| Locker ransomware | Locks the device or screen rather than encrypting data; more common on consumer devices | Usually recoverable by rebuilding the device |
| Double extortion | Steals data, then encrypts; threatens to publish if unpaid | Availability only; the data theft remains a breach |
| Data-theft extortion (no encryption) | Steals data and demands payment not to leak it | Nothing — it is a confidentiality problem |
| Wiper disguised as ransomware | Destroys data while showing a ransom note; paying cannot restore anything | Everything depends on offline backups |
| Ransomware as a service (RaaS) | A business model rather than a technique: developers rent the malware to affiliates who carry out attacks | Depends on the tactics used |
Notable ransomware attacks and their lessons
Large incidents get the headlines, but the causes are the same ones that hit small businesses:
| Attack | What happened | Lesson for a smaller organisation |
|---|---|---|
| WannaCry (May 2017) | Self-spreading ransomware exploited a Windows file-sharing flaw for which a patch already existed; NHS trusts in England were among the many organisations hit | Patch promptly and replace unsupported systems |
| NotPetya (June 2017) | Spread through a compromised update of Ukrainian accounting software; it posed as ransomware but was effectively a wiper, causing heavy losses at global companies | Suppliers’ software is part of your attack surface; offline backups matter most |
| Colonial Pipeline (May 2021) | Attackers used a compromised password for a VPN account without MFA; the company shut down its US fuel pipeline for several days and paid a ransom of about $4.4 million | MFA on every remote access route, including old accounts |
| Change Healthcare (February 2024) | Stolen credentials on a remote access portal without MFA; claims processing across US healthcare was disrupted for weeks and it became the largest healthcare data breach reported to HHS | One supplier’s outage can stop your cash flow — plan for it |
| Marks & Spencer (April 2025) | A cyber attack the company later attributed to a ransomware group halted online orders for more than six weeks; M&S estimated a hit of around £300 million to operating profit before mitigation and insurance | Help desk and third-party access are targets; rehearse running without key systems |
How a ransomware attack unfolds
An attack is a sequence, not a single event, and each stage is an opportunity to stop it. Knowing the stages helps you see which of your controls act where.
| Stage | What the attacker does | Controls that act here |
|---|---|---|
| 1. Initial access | Logs in with stolen or guessed credentials to a VPN, remote desktop or email account; exploits an unpatched firewall, VPN or file-transfer appliance; or gets a user to open a malicious attachment or link | MFA, patching of internet-facing systems, closing exposed remote desktop, email filtering, user reporting |
| 2. Establish a foothold | Installs remote access tools, often legitimate ones, so the access survives a password reset | Endpoint detection and response (EDR), application allow-listing, alerts on new remote tools |
| 3. Escalate and move | Harvests admin credentials, maps the network, reaches domain controllers, file servers and backup consoles | Separate admin accounts, no shared local admin passwords, network segmentation, monitoring of admin logins |
| 4. Steal data | Copies files to cloud storage or attacker servers for later extortion | Data minimisation, alerts on unusual outbound transfers, data loss prevention |
| 5. Disable defences and backups | Turns off security tools, deletes shadow copies, wipes or encrypts reachable backups | Tamper protection, immutable or offline backups, separate credentials for backup systems |
| 6. Encrypt and extort | Encrypts systems, leaves ransom notes, contacts staff, customers or the press, lists the victim on a leak site | Tested incident response plan, restore capability, legal and communications support |
The time between initial access and encryption varies from hours to weeks. A shorter gap means detection has to be faster; a longer gap means there was time to notice and you did not. Either way, the attackers’ priority at stage five is your backups, because restorable backups are the main reason a victim refuses to pay.
Double extortion and other pressure tactics
When good backups made pure encryption less profitable, groups shifted to double extortion: steal the data first, then demand payment both for decryption and for not publishing what was stolen. Some go further — threatening customers or patients directly, launching denial-of-service attacks on the victim’s website, or skipping encryption altogether and extorting on stolen data alone.
This changes the risk picture in two ways. First, good backups solve the availability problem but not the confidentiality problem: a ransomware attack with data theft is also a personal data breach, with notification duties that run regardless of whether you restore. Second, paying for deletion buys only a promise from a criminal; there is no way to verify that stolen data has been destroyed.
How to assess your ransomware risk
Treat ransomware as a specific scenario, not as “cyber attack” in general. A useful risk statement names the cause, the event and the consequence: “Attackers gain access through remote access or phishing, encrypt our systems and steal customer data, stopping order processing for more than a week and triggering breach notification.” Then score it on the same risk matrix as your other risks.
Likelihood: look at your exposure, not the headlines
General threat reports tell you ransomware is common. They do not tell you how likely it is for you. Your own exposure does. Ask:
- Is any remote desktop (RDP) service exposed directly to the internet?
- Is MFA enforced on every VPN, remote access tool, cloud admin console and email account — including the service accounts and the old ones nobody uses?
- How many days does it take to patch a critical vulnerability on your firewall, VPN or other internet-facing system? (A structured vulnerability management process answers this with data.)
- How many people have administrator rights on their everyday account?
- Do you run EDR on all servers and laptops, and does anyone look at its alerts out of hours?
- Does an IT supplier or managed service provider have remote admin access to your systems, and how is it protected?
If the honest answers include exposed remote desktop, gaps in MFA or patch times measured in months, rate likelihood high regardless of your size or sector.
Impact: start with recovery time
The biggest driver of ransomware impact is how long you are down. Two numbers matter:
- Recovery time objective (RTO) — how long the business can tolerate a system being unavailable before the damage becomes serious.
- Recovery point objective (RPO) — how much data, measured in time, you can afford to lose: the gap between the last good backup and the attack.
Then compare them with what you can actually achieve. The gap between the target and reality is your ransomware exposure in its most useful form.
| System | RTO needed | RPO needed | Realistic restore time today | Gap |
|---|---|---|---|---|
| Order processing / ecommerce back office | 24 hours | 1 hour | Unknown — never restored in full | Critical |
| Accounting and payroll | 5 days | 24 hours | 2 days from cloud provider backup | Within target |
| File server with customer contracts | 3 days | 24 hours | 4–5 days; backups on same network | High |
| Email and collaboration (SaaS) | 4 hours | 24 hours | Provider-dependent; no separate backup | Medium |
Beyond downtime, list the other consequences: cost of incident response and rebuilding, lost sales, contractual penalties, regulatory notifications and possible fines if personal data is stolen, and customer loss. Score impact on the worst credible outcome, not the worst imaginable one.
Inherent and residual scores
Score the risk once as if your controls did not exist, and again with the controls you actually have and have verified. The difference shows how much your controls are worth and which ones you depend on most. Our guide to inherent vs residual risk explains the method. For ransomware, be strict: a backup that has never been restored, or MFA that “should be on” for everyone, does not count as a working control until it has been tested.
Ransomware protection: controls that actually reduce the risk
Ransomware protection is not one product. It is a short list of unglamorous controls, done thoroughly. Government guidance — CISA’s #StopRansomware Guide in the US, the NCSC’s ransomware guidance in the UK, and Australia’s Essential Eight — converges on broadly the same set.
| Control | What it reduces | Priority for a small business |
|---|---|---|
| MFA on all remote access, email and admin consoles — phishing-resistant where possible | Likelihood of initial access with stolen passwords | Do first |
| No remote desktop exposed to the internet; VPN or zero-trust access instead | Likelihood of the most common brute-force entry point | Do first |
| Patch internet-facing systems within days for critical vulnerabilities; replace end-of-life devices | Likelihood of exploitation of firewalls, VPNs and file-transfer tools | Do first |
| Offline or immutable backups with separate credentials, restored in a test at least twice a year | Impact — recovery without paying | Do first |
| Separate admin accounts; remove local admin from everyday users; unique local admin passwords | Spread inside the network | Next |
| EDR on every endpoint and server, with alerts monitored out of hours (in-house or managed) | Dwell time before encryption | Next |
| Email filtering, attachment and macro controls, easy reporting of suspicious messages | Phishing as an entry route — see phishing risk | Next |
| Network segmentation between user devices, servers and backup systems | Spread and blast radius | Later, if complex |
| Controls on supplier and MSP remote access: MFA, named accounts, logging | Supply chain entry | Next |
| Incident response plan with ransomware playbook, contacts and a tabletop exercise | Impact — faster, better decisions on the day | Next |
| Data minimisation: delete what you do not need to keep | Extortion leverage and breach impact | Ongoing |
Antivirus alone is not ransomware protection. Most intrusions use legitimate tools and stolen credentials, which traditional signature-based antivirus is not designed to spot. EDR helps, but only if someone acts on the alert at 2 a.m. on a Sunday.
Backups that survive an attack
Attackers look for backups deliberately. A backup that sits on the same network, uses the same domain administrator account or can be deleted from the same console will usually go down with everything else. A ransomware-resilient backup has four properties:
- Separated. At least one copy is offline, or stored with a different provider, or immutable (cannot be changed or deleted for a set period, even by an administrator).
- Separately controlled. The backup system uses its own credentials with MFA, not your everyday domain admin account.
- Complete enough. It covers not just data but what you need to rebuild: configurations, licences, installation media, and documented rebuild steps.
- Tested. You have restored a whole critical system, not a single file, and timed it. That time is your real RTO.
Do not assume SaaS providers back up your data in a way that helps after a ransomware or account-takeover incident. Read what your provider commits to, and add a separate backup for critical cloud data where the commitment falls short.
Should you pay a ransom?
Governments, law enforcement and the NCSC all discourage payment. Paying does not guarantee you get a working decryptor or that stolen data is deleted, it funds further attacks, and paying once can mark you as a willing payer. Even so, the decision ultimately rests with the victim in most countries, and some organisations facing an existential outage do pay. What matters for risk management is that the decision is made deliberately, with legal advice, on the basis of a plan written in advance — not improvised under pressure.
Legal and sanctions issues
| Jurisdiction | Position (as at October 2026) |
|---|---|
| United States — OFAC | The Treasury’s Office of Foreign Assets Control’s 2021 updated advisory warns that paying, or facilitating payment to, a sanctioned person or group can breach US sanctions, and that liability is strict — you can be liable even if you did not know the recipient was sanctioned. OFAC treats meaningful cyber security improvements and prompt, full reporting to and cooperation with law enforcement as significant mitigating factors. |
| United States — CIRCIA | The Cyber Incident Reporting for Critical Infrastructure Act requires covered critical infrastructure entities to report ransom payments to CISA once the final rule takes effect. The proposed rule set 24 hours for payment reports; the final rule was still awaiting publication at the time of writing, so check current status. |
| United Kingdom | Payment to a sanctioned person is unlawful under UK sanctions law. Following a 2025 consultation, the government confirmed it intends to legislate for a ban on ransom payments by public sector bodies and operators of critical national infrastructure, alongside a payment prevention regime and mandatory incident reporting. At the time of writing these proposals had not become law; check the current position before relying on them. |
| Australia | Under the Cyber Security Act 2024, businesses with annual turnover above AUD 3 million (and certain critical infrastructure entities) must report ransomware or cyber extortion payments to the Australian Signals Directorate within 72 hours of paying or becoming aware of the payment. This applies from 30 May 2025. |
| EU | Paying sanctioned parties breaches EU sanctions. There is no general EU-wide payment ban; NIS2 incident reporting duties apply to entities in scope regardless of payment. |
In the UK, the NCSC published joint guidance with the main insurance industry bodies in May 2024 for organisations considering payment. It recommends, among other things, checking whether backups or other options make payment unnecessary, involving experienced external advisers, reporting to the authorities, and recording the decision and the reasons for it. That is good practice anywhere.
Decide your stance before the attack
Your board or owners should agree a position in calm conditions. A short pre-agreed stance might say: we will not pay unless restoring from backup is impossible and continued outage threatens the survival of the business; any payment requires legal advice, sanctions checks, insurer involvement and approval by named directors; and every step is recorded in the incident decision log. Write this into your risk appetite statement and your incident plan. Check your cyber insurance policy too — it will set out what the insurer must approve and which response firms you must use.
Ransomware in the risk register
One “ransomware” line is too coarse to manage. Break it into the scenarios that have different causes, owners and controls. Examples with illustrative residual scores on a 5×5 scale:
| Risk statement | Key controls | L | I | Score | Owner |
|---|---|---|---|---|---|
| Attacker uses stolen credentials on remote access to deploy ransomware, stopping order processing for over a week | MFA on VPN and email; no exposed RDP; EDR monitored by MSP | 2 | 5 | 10 | IT lead |
| Unpatched firewall or VPN appliance is exploited before a fix is applied | Critical patches within 7 days; asset list of internet-facing devices; vendor alerts | 3 | 5 | 15 | IT lead |
| Backups are encrypted or deleted along with production systems, forcing a choice between rebuild from scratch and payment | Immutable cloud backup; separate credentials; quarterly restore test | 2 | 5 | 10 | IT lead |
| Customer data stolen in an attack is published, triggering breach notification and loss of customers | Data minimisation; encryption at rest; breach response plan | 2 | 4 | 8 | Data protection lead |
| Managed service provider is compromised and its remote tools are used to deploy ransomware to clients | Contractual security terms; MFA on MSP access; review of MSP assurance | 2 | 5 | 10 | Operations director |
| Poor decisions under pressure during an attack (unplanned payment, delayed notification, missed sanctions check) | Incident plan with ransomware playbook; pre-agreed payment stance; annual tabletop exercise | 2 | 4 | 8 | Managing director |
The second line is deliberately high: for many small organisations the patching window on edge devices is the weakest point. If a supplier holds the keys, as in the fifth line, the assessment belongs in your third-party risk assessment too.
Key risk indicators for ransomware
Indicators tell you whether the controls behind those scores are still working. Pick a handful you can measure monthly without a project. More on design in our guide to key risk indicators.
| Indicator | Example thresholds |
|---|---|
| Accounts with remote or email access and no MFA | Green 0 · red any |
| Internet-facing systems with a critical vulnerability open longer than 7 days | Green 0 · amber 1 · red > 1 |
| Days since last successful full restore test of a critical system | Green < 180 · amber 180–365 · red > 365 |
| Endpoints and servers without a working EDR agent | Green 0 · amber 1–2% · red > 2% |
| Users with permanent administrator rights | Track against an agreed maximum; red if above |
| Measured restore time vs RTO for the most critical system | Green within RTO · red beyond RTO |
| Phishing report rate in the last simulation | Track the trend; aim for steady improvement |
If it happens: the first hours
Your full response belongs in an incident plan, but the first moves for ransomware are worth knowing by heart:
- Isolate, do not power off. Disconnect affected machines from the network; turning them off can destroy evidence held in memory.
- Protect the backups. Disconnect or lock down backup systems immediately if they are not already isolated.
- Call for help early. Your insurer’s incident line, your IT provider or an incident response firm, and law enforcement — Action Fraud or the NCSC in the UK, the FBI or CISA in the US.
- Start a decision log with times, facts known, decisions made and who made them.
- Do not contact the attackers until you have legal and specialist advice.
- Assume data was stolen until proven otherwise, and start the breach notification assessment in parallel.
Can you remove ransomware and get your files back?
Removing the malware is the easy part — endpoint tools or a rebuild will do it — but removal does not decrypt anything. Before anything else, check the No More Ransom portal, run since 2016 by Europol, the Dutch police and security companies, which offers free decryptors for ransomware strains whose encryption has been broken. Most modern strains have no free decryptor, so recovery normally means restoring from clean backups. Do not restore into a network the attacker still controls: find the entry point, reset credentials (especially admin and service accounts) and rebuild critical servers from known-good sources first, or you risk being encrypted again.
Our data breach response plan sets out the first 72 hours, notification duties and a plan template in detail.
Common mistakes
- Counting untested backups as a control. Until you have restored a whole system and timed it, you do not know your recovery time.
- MFA on email but not on the VPN, the remote management tool or the old admin account.
- Ignoring edge devices. Firewalls and VPN appliances are often the least monitored and slowest patched systems in the business.
- One vague register entry called “cyber attack” with no owner and a score nobody can explain.
- Leaving the payment decision to the day. Decide your stance, approvers and advisers in advance.
- Forgetting the data. Restoring systems does not end a double-extortion incident; notification duties may already be running.
Frequently asked questions
What is ransomware?
Ransomware is malicious software that encrypts an organisation’s files and systems so they cannot be used, followed by a demand for payment, usually in cryptocurrency, in exchange for a decryption key. Most attacks today also involve stealing data first and threatening to publish it, which is known as double extortion.
How does ransomware get into a business?
The most common routes are stolen or guessed passwords for remote access, VPNs and email accounts without multi-factor authentication; unpatched internet-facing systems such as firewalls and VPN appliances; phishing emails that install malware; and compromised IT suppliers or remote management tools.
What is the best protection against ransomware?
No single product. The controls that do the most are multi-factor authentication on all remote access and email, fast patching of internet-facing systems, removing unnecessary administrator rights, endpoint detection and response, and backups that are offline or immutable and have been restored in a test. Together they reduce both the chance of an attack and how much it hurts.
Is it illegal to pay a ransomware ransom?
In most countries paying is not illegal in itself, but paying a sanctioned person or group is. In the US, OFAC has warned that facilitating payments to sanctioned actors can lead to civil penalties, on a strict liability basis. The UK has confirmed plans to ban payments by public sector bodies and critical national infrastructure operators, and Australia requires larger businesses to report payments within 72 hours. Take legal advice before any payment.
How do you assess ransomware risk in a small business?
Write it as a scenario, score likelihood from your exposure (remote access, MFA coverage, patching speed, admin rights) and impact from how long you could operate without your systems and data, then compare your real recovery time with the recovery time objective the business needs. Record it in your risk register with owners, controls and indicators.
Is ransomware a type of malware?
Yes. Ransomware is malware designed to make data or systems unusable, usually by encryption, or to threaten to leak stolen data, in order to extort a payment. It is often delivered after attackers have already got in through stolen credentials, an unpatched system or another piece of malware.
What are the main types of ransomware?
Crypto ransomware that encrypts data, locker ransomware that locks devices, double extortion that steals and encrypts, data-theft extortion without encryption, and wipers disguised as ransomware. Ransomware as a service is the business model behind many of them.
Can you remove ransomware and get your files back?
Removing the malware does not decrypt your files. Check the No More Ransom portal for a free decryptor, but for most modern strains none exists, so recovery means restoring from clean, offline or immutable backups after closing the attacker’s way in and resetting credentials.
Keep ransomware risk visible, not vague
In Risk Samurai each ransomware scenario has an owner, linked controls, evidence such as restore tests, and indicators like MFA coverage and patch age — so a lapsed backup test shows up as a red flag before an attacker finds it. AI drafts the first version of your register.
Get early access