Ransomware is the scenario most business owners picture when they think “cyberattack” — and for good reason. It’s the attack most capable of stopping a company cold: every file encrypted, every system locked, operations frozen until you either restore from backups or pay a criminal group and hope.

Understanding how these attacks actually unfold is the first step to making your business a poor target.

Why small businesses, specifically

Owners often assume they’re too small to bother with. The economics say otherwise. Attackers ask a simple question: how hard is the target, and will they pay? Small and mid-sized businesses frequently combine valuable, urgently-needed data (client files, job schedules, billing) with thinner defenses than enterprises — no security team, inconsistent patching, backups nobody has tested. Much of the targeting is automated anyway: scanning tools probe the whole internet for exposed remote access and unpatched systems, and they don’t check your headcount first.

Ransomware also operates as a mature industry — ransomware-as-a-service — where developers lease their malware to affiliates who run the attacks and split proceeds. The result is volume: thousands of simultaneous, semi-automated campaigns for which a 40-person company is a perfectly good payday.

Anatomy of an attack

A modern ransomware incident is rarely a single click followed instantly by locked files. It’s a process, often spanning days or weeks — which matters, because each stage is a chance to catch it.

1. Initial access. The attacker gets in through one of a few well-worn doors: a phishing email that steals credentials or drops malware, an exposed remote access service (RDP or VPN) with a weak or stolen password and no MFA, an unpatched vulnerability in a firewall or server, or credentials bought from an earlier breach.

2. Foothold and escalation. Inside, the attacker quietly expands — harvesting more credentials, seeking admin rights, mapping the network to find servers, backups, and the most valuable data.

3. Data theft. Before encrypting anything, most crews now copy your data out first. This enables double extortion: pay to decrypt, and pay again or your client files, HR records, and financials get published. It’s why “we have backups” — while essential — is no longer a complete answer.

4. Kill the backups. Attackers specifically hunt for backup systems and delete or encrypt them before the main event. Any backup that’s reachable with the same credentials as the rest of the network is a backup that dies with the network.

5. Detonation. Often on a weekend or holiday night, encryption launches everywhere at once. Monday morning: nothing opens, and a ransom note names a price and a deadline.

What it actually costs

The ransom is the headline number, but usually not the biggest one. The full bill includes downtime (frequently one to several weeks of degraded or halted operations — for most SMBs the largest cost by far), recovery labor (rebuilding systems, restoring data, incident response and possibly forensics specialists), legal and notification obligations if personal data was taken (Oregon and Washington, like most states, require breach notification), and the slow costs: lost clients, lost trust, higher insurance premiums.

And paying doesn’t guarantee a clean ending — decryptors are often slow and buggy, stolen data may be sold anyway, and paying flags you as a payer. Law enforcement uniformly advises against it; sometimes businesses feel they have no other option, which is precisely the position preparation exists to prevent.

The defenses that actually matter

No single product stops ransomware. What works is layers, each disrupting a different attack stage:

  • MFA everywhere that matters — email, VPN, remote access, admin accounts. This slams the most common entry door. (Full MFA guide here.)
  • Patch promptly. Most exploited vulnerabilities have had fixes available for months. A disciplined monthly patch cycle, plus fast-tracking for actively-exploited flaws, removes the second most common door.
  • Close exposed remote access. RDP open to the internet is an invitation. Remote access belongs behind a VPN or modern zero-trust tooling, with MFA.
  • EDR/MDR — detection and response. Traditional antivirus checks files against known signatures; endpoint detection and response watches behavior (mass file encryption, credential dumping) and can isolate a machine automatically. Managed detection and response adds humans watching the alerts 24/7 — critical, since detonation deliberately happens when your office is empty.
  • Backups built for ransomware. Follow the 3-2-1 rule, and make at least one copy immutable or offline — unreachable even with stolen admin credentials. Then test restores on a schedule. A backup you haven’t restored from is a hope, not a plan.
  • Least privilege. Employees (and their day-to-day accounts) shouldn’t have admin rights. What a compromised account can’t reach, ransomware can’t encrypt.
  • Trained people. Phishing starts most of these chains. Staff who recognize it — and report fast, without fear of blame — are a genuine security layer. (Phishing red flags here.)
  • A written incident response plan. One page is enough to start: who to call (IT provider, insurer’s breach hotline, attorney), in what order, and who decides what — printed, because the plan that only exists on an encrypted server helps no one.

If it happens anyway: the first hour

  1. Isolate. Disconnect affected machines from the network — pull the cable or kill Wi-Fi. Don’t power them off; memory can hold evidence responders need.
  2. Call for help. Your IT provider or internal team first, then your cyber insurer’s breach line — most policies require prompt notice and provide response resources.
  3. Don’t negotiate alone and don’t pay reflexively. Decisions this large need your insurer, counsel, and responders in the room.
  4. Preserve, don’t wipe. The urge to reformat everything destroys the evidence needed to learn how they got in — leave the door open and they’ll be back.
  5. Report it. In the U.S., the FBI’s IC3 (ic3.gov) and CISA take reports; law enforcement sometimes has decryption keys from prior takedowns.

The realistic goal

You can’t make a business unhackable. You can make it resilient: hard enough to breach that automated attacks move on, monitored well enough that intrusions get caught in the quiet early stages, and backed up well enough that even a successful detonation means restoring data instead of negotiating with criminals. That standard is thoroughly achievable for a small business — it’s a set of practices, not a seven-figure security budget.