It's 11 p.m. on a Sunday, and your phone buzzes with an alert from your accounting software. Someone just logged in from a city you've never visited. By Monday morning, every spreadsheet, invoice, and client contract on your network is a scrambled mess with a single text file sitting on the desktop: pay up, or lose everything.
That's ransomware in its purest form. It's not a virus that crashes your computer. It's a business model. And in 2026, it's one of the most profitable criminal enterprises on the planet.
I've spent the last few years helping small businesses dig themselves out of these messes. Some recovered. Some didn't. The difference almost always came down to what they did before the attack, not during it. So let's talk about ransomware: what it is, how it gets in, and how you actually prevent it without turning your company into a fortress nobody can work in.
Key Takeaways
- Ransomware is malicious software that encrypts your files and demands payment for the decryption key.
- Most infections start with a phishing email or a stolen remote-access credential, not some exotic hacker exploit.
- Offline, tested backups are the single most effective defense. If you can restore, the ransom loses its leverage.
- Modern attacks use double extortion: they steal your data first, then encrypt it, so paying doesn't guarantee silence.
- Multi-factor authentication on every remote login blocks a huge share of real-world intrusions.
- Prevention is cheaper than recovery, every single time. I've never seen a client regret spending on backups.
What is ransomware, exactly?
Ransomware is malware that takes your data hostage. Once it runs on a machine, it quietly encrypts documents, databases, images, and anything else it can reach, then locks the key behind a payment. Modern variants don't stop at one laptop. They spread across shared drives, servers, and cloud backups before the first ransom note even appears.
The encryption itself is often solid. Criminals use the same cryptographic standards your bank does, which is why "just decrypt it yourself" is rarely realistic. The weak point was never the math. It's the human who clicked something, or the server nobody patched.
How has ransomware evolved since 2021?
Five years ago, the playbook was simple: encrypt, demand Bitcoin, move on. Today it's a full extortion operation. Attackers typically exfiltrate your files first, then encrypt them, then threaten to publish everything if you don't pay. This is double extortion, and it changes the calculus completely. Restoring from backup no longer solves your problem, because the stolen data is still out there.
I watched a mid-sized logistics firm go through this two years ago. They had good backups. They restored in about 36 hours. But the attackers had already copied 40 GB of customer contracts and emailed a sample to three of their biggest clients. The ransom demand shifted from "unlock your files" to "keep your reputation." They paid a fraction of the original ask, and it still cost them two accounts.
Types of ransomware you should know
Not all ransomware behaves the same way, and knowing the category tells you how fast you need to move:
- Encrypting ransomware — the classic. Locks files, demands a key. Most common by far.
- Locker ransomware — locks you out of the whole device rather than individual files.
- Scareware — fake warnings claiming you're infected, hoping you'll pay for imaginary "cleanup."
- Ransomware-as-a-Service (RaaS) — a franchise model where developers rent their malware to affiliates for a cut of the profits. This is why attacks scaled so fast.
- Leakware, or doxware — pure blackmail. No encryption at all, just stolen data and a threat.
How ransomware actually gets in
Here's the thing nobody wants to hear: attackers rarely break in through some genius technical exploit. They walk through the front door you left unlocked.
The top infection routes I see, ranked by how often they show up in real incidents:
- Phishing emails with a malicious attachment or a link to a fake login page. Still number one.
- Stolen or brute-forced remote desktop credentials — especially on systems exposed directly to the internet. A weak password on an RDP port is an open invitation.
- Unpatched software and outdated VPN appliances. Attackers scan for known vulnerabilities constantly.
- Malicious ads and compromised websites that push drive-by downloads.
- Infected USB drives and, occasionally, insider help.
What is the top way ransomware infections occur?
The single most common entry point is still phishing. A convincing email lands in an inbox, someone opens the attachment or enters credentials on a lookalike page, and the attackers are inside. In most incidents I've helped clean up, the initial foothold traced back to one email and one person who was tired, rushed, or simply caught off guard.
That's not a reason to blame employees. It's a reason to build defenses that assume someone will eventually click.
How can ransomware infect your device?
On a personal device, the story is usually short. You download something you shouldn't have, or you plug in a USB stick you found, or you click a link in a message that looked legitimate. The malware runs, and encryption starts within seconds.
On a business network, it's a slower burn. Attackers often spend days or weeks inside before triggering the payload. They map your systems, escalate their privileges, and disable your security tools. Ransomware is the final move, not the first.
Which brings up an obvious problem: by the time you see the ransom note, the damage is already done. You're not responding to an attack. You're responding to a completed one.
Ransomware prevention checklist
You don't need an enterprise security budget to make yourself a hard target. You need a handful of habits and controls that actually hold up under pressure. Here's what works, based on what I've seen save companies and what their absence has cost them.
| Measure | Effort | Impact |
|---|---|---|
| Offline, tested backups (3-2-1 rule) | Medium | Very high |
| Multi-factor authentication everywhere | Low | Very high |
| Phishing awareness training | Low | High |
| Prompt patching of systems and VPNs | Medium | High |
| Network segmentation | High | Medium to high |
| Endpoint detection and response tools | Medium | Medium |
Backups are non-negotiable
Follow the 3-2-1 rule: three copies of your data, on two different media, with one copy kept offline or off-site. The offline part matters enormously, because modern ransomware hunts for connected backups and encrypts them too.
And test your restores. A backup you've never tried to recover is a hope, not a plan. I once worked with a firm that had immaculate backups, only to discover the restore process took four days because nobody had ever rehearsed it. Four days of downtime is a business-threatening event for most small companies.
Close the door on remote access
Turn on multi-factor authentication for every remote login, email account, and admin console. It's the cheapest, highest-return move on this list. Then get remote desktop services off the open internet entirely, or put them behind a VPN with strong authentication.
Train people, then train them again
Run realistic phishing simulations. Not to catch and shame anyone, but to build reflexes. When someone reports a suspicious email instead of clicking it, thank them publicly. You want a culture where flagging things is normal, not embarrassing.
Patch fast, and segment
Apply security updates quickly, especially on anything facing the internet. Then split your network so an infection on one machine can't crawl straight to your servers. It won't stop the initial breach, but it slows the spread, and slowing the spread buys you time to respond.
What to do if you get hit anyway
Assume prevention will eventually fail somewhere. When it does:
- Disconnect the affected systems from the network immediately.
- Do not reboot unless a specialist tells you to — you may destroy evidence or trigger further encryption.
- Report the incident to the relevant authorities. In many jurisdictions this is a legal obligation, not a choice.
- Restore from a clean, offline backup rather than paying.
- Bring in people who do this for a living. Ransomware response is not a solo project.
Should you ever pay? I'll be blunt: paying funds the next attack, doesn't guarantee you'll get your data back, and can mark you as a repeat target. I've seen one company pay and recover fully, and I've seen two pay and get nothing but a second demand. The odds aren't in your favor.
The honest bottom line
Ransomware isn't a technical problem you solve once. It's a risk you manage continuously, and the organizations that handle it well aren't the ones with the biggest security budgets. They're the ones who assumed they'd get hit and prepared accordingly.
So here's the question worth sitting with: if the ransom note appeared on your screen tomorrow morning, how much of your business would still be standing by Friday? If you don't like the answer, you already know where to start.
