In short: Ransomware encrypts a company's files and demands a ransom. It gets in through deceptive emails, weak passwords, outdated software and exposed remote access. The defences that count are separate, tested backups, updates, two-factor authentication, few privileges and training. If it happens: isolate, call a technician and don't rush to pay.
Ransomware is a program that encrypts a company's files and demands money to give them back. It doesn't only hit large groups. Small and medium-sized businesses are frequent targets because they hold valuable data and have weaker defences.
How it gets in
- Emails with deceptive attachments or links (phishing). Someone opens them and the program runs.
- Weak or reused passwords on remote access, email and admin panels.
- Outdated software: a server, management software or a website with known flaws.
- Exposed remote access, such as remote desktop open to the internet without protection.
- Suppliers and contractors with overly broad access.
The defences that carry the most weight
1. Separate, tested backups
This is the defence that decides whether an attack is a nuisance or a disaster. The copies must be kept outside the main network and at least one must be impossible to modify from the connected computers. Test the restore. You'll find the method in backups that actually work.
2. Updates
Operating systems, management software, routers, websites and plugins need updating regularly. Many intrusions exploit flaws that were fixed months ago.
3. Two-factor authentication
On email, remote access and admin panels. A stolen password on its own is no longer enough to get in.
4. Few privileges
Everyone accesses only what they need. The system administrator account is not the one used to read email.
5. Protecting computers
Up-to-date antivirus software that detects suspicious behaviour. On servers, a more advanced monitoring tool.
6. Short, regular training
Half an hour every so often to recognise a suspicious message and to know who to report it to without fear of being told off. Whoever reports it straight away saves days.
7. Network segmentation
If one computer is hit, the attack shouldn't reach everything. Separating the key servers from the rest limits the damage.
If your files are locked
- Isolate. Disconnect the affected computers from the network (cable and Wi-Fi). Don't switch off the servers without a technician's advice: their memory may hold useful information.
- Don't rush to pay and don't reply to the attackers. Paying does not ensure you get your files back and it feeds the problem.
- Call the people who handle this. A technician or a security provider.
- Check the backups and make sure they haven't been touched.
- Change the passwords after isolating the systems, from a clean computer.
- Assess your legal obligations. If personal data is involved, the breach must be notified to the Garante, Italy's data protection authority, within 72 hours. Organisations subject to the NIS2 Directive have further notifications to make.
- File a report with the Polizia Postale, the Italian police unit for cybercrime.
A quick check to do today
- When was the last backup taken and where is it kept?
- Who has administrator access, and do they still need it?
- Does your email have two-factor authentication?
- Are there computers or servers running software that is no longer updated?
Further reading: hacked website · passwords and two-factor authentication · phishing at work · website care and maintenance
Frequently asked questions
How does ransomware get into a business?
Mainly through emails with deceptive attachments or links, weak or reused passwords, outdated software with known flaws, exposed remote access and suppliers with overly broad access.
What should you do if your files are locked?
Isolate the affected computers from the network, don't reply to the attackers, call a technician or a security provider, check the backups, change the passwords from a clean computer and assess the notifications required by law.
Is it worth paying the ransom?
Paying does not ensure you recover your data and it feeds the problem. First check the backups and ask experts for help.