Ransomware and small businesses: how to prevent it, and what to do in the first hours

Ransomware is malicious software that encrypts your files and systems, followed by a demand for payment to unlock them. Many groups now also steal data first and threaten to publish it. Small businesses are targeted because they hold money and customer data and often lack a full-time IT person.

The common ways in are ordinary:

• A phishing email with a malicious attachment or a link to a fake login page. See how to spot phishing.
• A stolen or reused password on remote access, email or a VPN with no multi-factor sign-in.
• An unpatched system on the internet, such as a firewall, VPN appliance, remote desktop server or file-sharing tool with a known vulnerability.
• A trusted supplier whose remote-support tool or account is compromised.

CISA's #StopRansomware Guide is written for organizations of every size. For a small business, its core advice comes down to five things:

1. Offline, encrypted backups of critical data, tested regularly, because many ransomware strains look for reachable backups and delete or encrypt them. Our small business backups guide covers the 3-2-1 rule.
2. Phishing-resistant multi-factor authentication for all services, starting with email, remote access and admin accounts. Security keys and passkeys qualify; see passkeys.
3. Patching, with internet-facing systems and known exploited vulnerabilities first. Turn on automatic updates for computers and check the firewall and router firmware.
4. Email defenses: filtering, warnings on external email, DMARC on your domain (see SPF, DKIM and DMARC) and blocking macros in Office files from the internet.
5. Staff awareness: a short, regular reminder of how to recognize and report a suspicious message, and a culture where reporting a mistake is welcome.

Also close what you do not use: remote desktop exposed to the internet, old admin accounts and former employees' logins. The rest of the baseline is in our small business security checklist.

Modern endpoint protection (EDR) watches for ransomware behavior, such as one program rapidly encrypting files, and can stop and roll back some attacks. It only helps if someone acts on the alerts, which is why small teams with no IT staff should consider a managed (MDR) option. If you pay for Microsoft 365 Business Premium, Defender for Business is already included; start there.

Otherwise, dedicated options include CrowdStrike Falcon Go and Bitdefender GravityZone, alongside non-partners such as SentinelOne, Sophos and ESET. We compare them in our endpoint protection guide.

CISA's response checklist starts with three steps, in this order:

1. Identify and isolate affected systems immediately. Unplug the network cable and turn off Wi-Fi on affected computers. If several are affected, take the network offline at the switch or router.
2. Power down only if you cannot disconnect. CISA says to power down devices if you are unable to disconnect them from the network, because powering off destroys evidence held in memory.
3. Triage what needs restoring first, and keep track of systems that appear unaffected.

Then:

• Use a phone, not company email, to coordinate. The attacker may be reading your email.
• Do not wipe or reinstall anything yet. Keep the ransom note and any messages; take photos of screens.
• Call your cyber insurer if you have one, before hiring anyone. Many policies require you to use their approved response firms.
• Report it: the FBI's Internet Crime Complaint Center or your local FBI field office, and CISA at cisa.gov/report. CISA's guide notes that law enforcement may know of a decryptor for your strain.
• If customer data may have been taken, your state's breach notification law may apply. Get legal advice on notification.

The FBI does not support paying a ransom (FBI). Its reasons: paying does not guarantee you get your data back, and it encourages criminals to target more victims. Data that was stolen before encryption can still be published or sold after payment.

There is a legal risk too. The US Treasury's Office of Foreign Assets Control has warned that paying ransoms to sanctioned people or groups can violate US sanctions (OFAC). Whatever you decide, report the attack first and make the decision with law enforcement, your insurer and a lawyer, not alone at 2 a.m. This is general information, not legal advice.