- Most ransomware starts with something ordinary: a stolen password, an unpatched system or a convincing email.
- Attackers usually spend days inside before they lock anything, so early detection gives you time to act.
- Tested, separate backups and fast response decide how bad the day becomes.
What ransomware is
Ransomware is malicious software that locks or steals your data and demands payment. Modern attacks often do both: they copy sensitive files first, then encrypt systems, and threaten to publish the data if you refuse to pay. That second threat means even good backups do not remove all of the risk.
How attacks usually begin
- Stolen or guessed passwords used on remote access, email or cloud accounts that do not require a second step.
- Phishing emails that trick someone into running a file or entering credentials on a fake page.
- Unpatched internet-facing systems such as VPNs, firewalls and servers with known flaws.
- Exposed remote desktop or admin services left open to the internet.
- A trusted third party whose access or software is abused to reach you.
None of these needs unusual skill. That is why basic controls work so well. See ten security controls every small business needs for a starting order.
What happens between the first click and the lock-up
- 1Entry. The attacker gets a foothold on one device or account.
- 2Exploring. They look around, find what you have and try to gain more access.
- 3Taking control. They aim for administrator accounts and your backups.
- 4Stealing data. Files are copied out, often quietly over days.
- 5Locking systems. Encryption is triggered, often at night or at a weekend.
Every stage before the last is a chance to notice. Unusual sign-ins, new administrator accounts, security tools being switched off and large outbound transfers are all signals that threat detection and threat hunting are designed to catch.
How to stop it
- Require multi-factor authentication on remote access, email, cloud and all administrator accounts.
- Patch quickly and give priority to anything reachable from the internet.
- Use modern endpoint protection that blocks suspicious behaviour, with someone watching its alerts around the clock.
- Protect your backups. Keep copies that attackers cannot reach or change, and test restoring them.
- Limit administrator rights and separate admin accounts from everyday ones.
- Segment the network so one infected device cannot reach everything.
- Train staff to report suspicious email quickly, and make reporting blame-free.
If it happens anyway
Isolate affected devices from the network, do not wipe them yet, call your incident responders and your insurer, and work out what data may have been taken. Do not rush to pay: payment does not guarantee recovery and can raise legal questions. Have incident response help available before you need it, and plan how to restore using business continuity and disaster recovery.
Further reading
Independent sources we recommend for more detail.