Ransomware is malware that encrypts the files on your systems and demands payment to restore access. In recent years attackers also copy data before encrypting it and use double extortion, threatening to publish the data if no payment is made. That makes ransomware a business continuity and reputation issue, not just an IT problem.
How attacks start
- An attachment or link in a phishing email,
- Remote access accounts taken over through stolen or weak passwords,
- Unpatched servers, VPNs or firewalls,
- Poorly secured supplier connections.
Prevention: make the attacker's job hard
- Multi-factor authentication: Enforce it on email, VPN and admin panels.
- Patch management: Do not delay updates, especially on internet-facing systems.
- Endpoint detection and response (EDR): Use a solution that spots suspicious behaviour early.
- Least privilege: Give users access only to the folders they need.
- Network segmentation: Separate critical servers from the user network.
- Awareness: Keep staff informed about phishing on a regular basis.
Backup: the last line of defence
Attackers now target backups too. At least one copy must be offline or immutable. Regular restore tests tell you in advance how long recovery will take.
What to do during an attack
- Disconnect affected devices from the network, but do not switch them off; evidence may be needed.
- Change admin passwords and remote access credentials.
- Establish the scope: which systems and which data are affected?
- Restore from clean backups in a controlled way.
- If personal data is involved, assess your notification duties under data protection law.
- Find the root cause afterwards and prevent a repeat.
Should you pay?
Paying does not guarantee you will get your data back or that it will not be published, and it can make you a target again. The strongest strategy is a backup and recovery plan that makes payment unnecessary.
ujans prepares businesses for ransomware with security assessments, EDR, immutable backups and incident response planning.