Ransomware in SMEs: how it works and how to recover

Ransomware is the nightmare most feared by companies that have already suffered it, and most ignored by those that have not. It is an attack that encrypts your data and demands a ransom to give it back. We explain how it works, what to do if it hits you and, above all, how not to reach that point.

What ransomware is

It is a type of malicious program that, once inside, encrypts your files and leaves them inaccessible. Then a message appears demanding a payment, usually in cryptocurrency, in exchange for the key to recover them. It is a hostage-taking of your data, and for many companies it means stopping dead.

How it gets into a company

• Through a phishing email with a booby-trapped attachment or link.
• Through a stolen or weak password, especially without two-factor.
• Through an unpatched system with a known hole.
• Through poorly protected remote access.

There is almost always a human factor at the start: someone in a hurry who clicked. That is why training matters so much.

What to do if it hits you

If you suspect you are under attack, act fast and with a clear head:

• Isolate the affected machines: disconnect them from the network to stop it spreading.
• Do not shut down blindly: you can sometimes lose information useful for recovery.
• Alert your IT team or your partner right away.
• Do not pay the ransom on impulse: paying does not guarantee you get the data back and marks you as a target.
• Recover from your backups, which is the reliable way back.

The difference between a scare and a shutdown: backups

A company with tested, isolated backups can restore and carry on, even if it loses a few hours. A company with no backups, or with backups the attack also encrypted, is left with no way out. That is why we insist so much on backups outside the network that are actually tested, including Microsoft 365.

How to prevent it

The same four measures as always remove most of the risk: two-factor on email and access, tested and immutable backups, endpoint and email protection, and a team trained not to take the bait. We cover it in cybersecurity for businesses, and we put numbers on the real cost of an attack in how much a cyberattack costs an SME.

Frequently asked questions

What is ransomware?

It is a malicious program that encrypts your company's data and demands a ransom to give it back. It leaves files inaccessible and, for many companies, means stopping activity.

Should you pay the ransom?

It is not advisable. Paying does not guarantee recovering the data, funds the attackers and marks you as a target. The reliable way back is to restore from backups.

How do you prevent ransomware?

With multi-factor authentication, tested and immutable backups, endpoint and email protection, up-to-date patching and team training against phishing.