Ransomware

Malicious software that encrypts your data and demands payment. Recovery depends almost entirely on your backups.

What it means

Ransomware encrypts files and demands a ransom for the key. Modern attacks usually also steal the data first and threaten to publish it, so paying does not remove the breach.

Entry is commonly through phishing, a stolen password, or an unpatched internet-facing system.

Why it matters

For a small business, the practical question is not whether you can decrypt but whether you can rebuild. That depends on backups that exist, are recent, and are not reachable from the infected network.

There is also a data protection dimension: stolen personal data is a breach reportable to the ICO within 72 hours.

What it looks like in practice

The 3-2-1 rule: three copies of the data, on two different media, one of them off-site and offline or immutable.

Test restores. An untested backup is a hope.

Patch promptly, especially anything exposed to the internet, and remove local administrator rights from day-to-day accounts.

Have a plan that does not depend on your own systems: contacts, insurance details, and the order in which you would rebuild.

What to watch out for

Backups on a mapped network drive, which ransomware encrypts along with everything else.

Paying. Law enforcement advises against it, there is no guarantee of recovery, and sanctions issues can arise depending on who is paid.

Where to get proper advice

The NCSC's ransomware guidance and its Small Business Guide. Report to Report Fraud, and notify the ICO if personal data is affected.