What Ransomware Actually Does to a Business

Ransomware is one of those terms that gets used constantly without always being explained. Most people have a rough sense that it's "bad" and involves being locked out of something, but the practical reality of what it does — and why it causes so much disruption — is worth understanding properly, because the risk applies just as much to a small business as to a large one.

What it actually does

Ransomware is malicious software that encrypts files on a computer or network, making them unreadable without a specific decryption key. Once it's run, documents, databases, and sometimes entire systems become inaccessible, and a message typically appears demanding payment — usually in cryptocurrency — in exchange for that key. In many modern cases, attackers also quietly copy sensitive data out before encrypting anything, then threaten to publish or sell it separately as additional leverage.

How it typically gets in

There's rarely a single dramatic break-in. Common routes include a phishing email with a malicious attachment or link, a remote access tool left exposed to the internet with a weak password, or software that hasn't been updated with known security fixes. None of these require a particularly sophisticated attacker — they're simply the paths of least resistance, and automated tools exist that scan constantly for exactly this kind of opening.

The disruption goes well beyond the ransom itself

Even setting aside whether to pay (which carries no guarantee the files will actually be restored, and which law enforcement generally advises against), the practical disruption is often the bigger problem: systems offline, staff unable to work, orders or appointments unable to be processed, and a recovery process that can take days even in a reasonably well-prepared business — longer if backups aren't solid or weren't actually tested.

Why backups alone aren't a complete answer

Good backups are essential, but they're not automatically a full solution. Attackers increasingly look for and target connected backup systems specifically, which is why backups genuinely isolated from the main network (sometimes called offline or "air-gapped" backups) matter so much. It's also worth knowing in advance roughly how long a full restore would actually take — a backup that technically exists but would take a week to restore from still means a week without your systems.

Prevention is where the real leverage is

Because recovery is so disruptive even when it goes well, the controls that reduce the chance of ransomware getting in at all — patching software promptly, multi-factor authentication on anything remotely accessible, staff trained to spot phishing attempts, and no unnecessarily exposed remote access — do far more for a business than any plan for what happens after the fact.

If you're not confident your current backup and recovery setup would actually hold up against this, or want a proper review of how exposed your systems are, our cyber security page covers how we can help, or get in touch directly.