Ransomware is malicious software that encrypts your files and demands payment to unlock them – often while also stealing data and threatening to publish it. Small businesses are frequent targets because their defences are weaker. The good news: a handful of basic controls stop most attacks.
How attackers usually get in
- Phishing emails with malicious attachments or fake login pages
- Stolen or reused passwords on email, VPN or remote desktop
- Unpatched software, firewalls and VPN devices
- Remote desktop (RDP) exposed directly to the internet
- Pirated software and infected USB drives
The prevention checklist
| Control | What to do | Priority |
|---|---|---|
| Backups | Follow 3-2-1: three copies, two media, one offline or immutable. Test restores every quarter. | Critical |
| Multi-factor authentication | On email, cloud apps, VPN and every admin account. | Critical |
| Patching | Automatic updates for Windows, browsers and Office; patch firewalls and VPNs quickly. | Critical |
| Remote access | Never expose RDP to the internet; use a VPN or zero-trust access with MFA. | High |
| Endpoint protection | Modern antivirus / EDR on every laptop and server. | High |
| Least privilege | Staff don't use admin accounts for daily work. | High |
| Email security | Spam and attachment filtering; SPF, DKIM and DMARC on your domain. | High |
| Training | Short phishing awareness sessions and simulated phishing tests. | Medium |
If you are hit: the first hour
- Isolate: disconnect affected machines from the network and Wi-Fi. Don't switch them off – evidence matters.
- Call your incident response partner and your cyber insurer if you have one.
- Preserve evidence: ransom notes, logs and screenshots.
- Report: to CERT-In within 6 hours, and to the police cyber cell. If personal data is affected, DPDP Act breach duties also apply.
- Reset credentials from a clean device, starting with admin and email accounts.
- Restore from clean backups only after the attacker's access has been removed.
Should you pay the ransom?
Authorities advise against paying. Payment does not guarantee working decryption, it funds further crime, and stolen data may still be leaked. Tested backups are what let you say no.
Tinos offers cyber security services including VAPT, backup and security reviews and incident response. See also our security basics for SMEs.
Frequently asked questions
Are small businesses really targeted?
Yes. Many attacks are automated and look for any weak system, regardless of company size. Smaller firms are often easier to break into.
Does antivirus alone protect us?
No. Antivirus is one layer. Backups, MFA, patching and trained staff matter just as much.
How often should we test backups?
At least every quarter, and after major changes. Restore real files to confirm the backup is complete and usable.
