What is ransomware?

Ransomware is malicious software that locks or encrypts your business's files and systems so you can't use them, then demands payment to unlock them. Many attackers also steal copies of the data and threaten to publish it. It usually gets in through phishing emails, stolen passwords or out-of-date software. Offline backups are your best safety net.

Ransomware is the attack that makes the news, because it can stop a business in its tracks. It's also one of the more preventable problems, and the most important defense is something you can set up this week.

How does ransomware work?

Attackers first need a way in. CISA's guidance points to a few common routes:

• Phishing emails deliver a harmful link or attachment.
• Stolen or weak passwords let attackers into remote access tools, VPNs or email.
• Unpatched software leaves holes, especially on systems that face the internet.

Once inside, the ransomware spreads to as many files and computers as it can reach, then encrypts them. A ransom note appears asking for payment. Many groups also copy your data first and threaten to release it, which CISA calls double extortion. Some deliberately hunt for backups they can reach, so those get encrypted too.

Why does ransomware matter for small businesses?

A small business often keeps everything in one place: client files, accounting, scheduling. If that's locked, work stops. Recovery can take days or weeks, and there may be notification duties if customer data was stolen.

Small businesses aren't too small to be targeted. Many attacks are automated and simply look for an open door.

How do I protect my business from ransomware?

• Keep offline, encrypted backups of important data, and test restoring them. CISA stresses offline because many ransomware variants try to find and delete accessible backups.
• Turn on multifactor authentication for email, remote access and admin accounts.
• Keep software updated, including operating systems, your website platform and plugins.
• Train your team to spot and report suspicious emails.
• Write a short plan covering who to call and where backups live, and keep a printed copy in case systems are down.

Our small business cybersecurity checklist turns these into a step-by-step list, and a risk assessment helps you decide what to tackle first.

Ransomware vs other malware

All ransomware is malware, but not all malware is ransomware. Other malware might quietly steal passwords or send spam. Ransomware announces itself, because the whole point is to get paid.

If you're hit, CISA advises reporting to federal law enforcement through IC3. A free CyberVigil scan won't detect ransomware, but it can show public-facing gaps like outdated encryption or missing email protection that are worth closing.