What Is Ransomware? A Plain-English Guide for Small Business Owners

The short version

Ransomware is a type of malicious software that makes your data unusable, usually by encrypting it, and then demands payment for the key. For a small business the effect is simple and brutal: invoices, customer records, shared drives and sometimes the systems that run the till or the phones stop working until the problem is resolved.

Many attacks today also involve data theft before encryption. The criminals threaten to publish the stolen files, which means that restoring from backup solves the downtime but not the privacy problem. That is why prevention matters as much as recovery.

How ransomware gets in

Attackers rarely need anything clever. They use the doors that small businesses leave open, and most of those doors fall into a few well-known categories.

• Phishing emails with attachments or links that install malware or capture a login
• Exposed remote access, such as remote desktop or a VPN protected only by a password
• Software with known vulnerabilities that has not been updated
• Compromised accounts of suppliers or contractors who already have access
• Infected downloads, cracked software and fake update prompts

What an attack looks like in practice

Often there is a quiet period first. Someone gains access, looks around, steals data and looks for your backups. Only then do they trigger the encryption, frequently outside working hours so that nobody notices until the next morning.

The first sign may be files with strange extensions, a text file or wallpaper containing a ransom note, or systems that suddenly will not open. If you see this, treat it as an emergency rather than a glitch and isolate the device quickly by unplugging the network cable or turning off Wi-Fi.

The layers that actually reduce risk

No single product solves ransomware. The goal is to make each stage of the attack harder, so that a single mistake by one employee does not become a company-wide outage.

• Multi-factor authentication on email, VPN, remote access and admin accounts
• Automatic updates for operating systems, browsers and business software
• Endpoint protection on every computer and server, kept up to date
• Standard user accounts for daily work, with admin rights only where needed
• Email filtering and short, regular phishing awareness training
• Network separation so one infected laptop cannot reach everything

Backups: the part that decides how bad it gets

A good backup turns a catastrophe into a bad week. The standard guidance is to keep several copies, on different types of storage, with at least one copy offline or immutable so that attackers cannot delete it.

Just as important is testing. Pick a folder and a whole machine at least twice a year and restore them to confirm that the backup works and to learn how long it really takes. A backup you have never restored is an assumption.

If it happens to you

Stay calm and follow a written plan. Disconnect affected machines, avoid wiping anything until someone has captured the evidence, and call your IT provider or an incident response specialist. Inform your cyber insurer early if you have a policy, because many require notification before you take certain steps.

You may also have legal duties to tell customers, regulators or the police depending on what data was involved and where you operate. Get proper advice rather than guessing. Afterwards, change passwords, close the entry point and review what you learned.

Common myths that leave businesses exposed

We are too small to be a target is the most expensive assumption in this area. Attackers often scan the internet automatically for weak spots, and they do not know or care how big you are until they are already inside. A ten-person firm with customer records and no spare IT capacity can be an attractive target precisely because recovery is hard and the pressure to resolve things quickly is high.

Another myth is that cloud services make you immune. Cloud suites reduce some risks, but synced folders can replicate encrypted files, and stolen logins to a cloud account give an attacker the same access as the employee. Check how version history and file recovery work in the services you use, and know how far back you can roll.

A third is that insurance replaces security. Cyber insurance can help with response costs, but insurers increasingly ask about multi-factor authentication, backups and patching before they offer cover, and a claim can be complicated by missing basics. Treat the policy as a safety net behind your controls, not a substitute for them.

Questions to ask your IT provider this month

If you rely on an outside IT supplier, ask them direct questions and expect clear answers rather than reassurance. They are a quick way to find the gaps before an attacker does.

If this all feels like too much, begin with three things this week: turn on multi-factor authentication for email and admin accounts, check that your backups exist and are separate from the main network, and make sure automatic updates are enabled. Those three steps address a large share of the realistic risk without a big budget.

• Where are our backups stored, and could an attacker with admin access delete them?
• When did we last restore a full machine from backup, and how long did it take?
• Which accounts have administrator rights, and do they all use multi-factor authentication?
• Is remote access to our network exposed to the internet, and how is it protected?
• How quickly are security updates applied to laptops, servers and network devices?
• Who do we call at midnight on a Sunday, and what is the first thing they will do?