Ransomware is a type of malicious software that encrypts a victim's files or entire systems, then demands a ransom payment in exchange for the decryption key. For businesses, the consequences reach well beyond the ransom itself: downtime, lost data, reputational damage, and potential regulatory penalties can stack up fast. Attacks have grown more targeted and sophisticated over the past several years, and small and mid-sized businesses are now hit as frequently as large enterprises.
How ransomware actually works
Most ransomware attacks follow a recognisable pattern. The attacker gains access to a network, typically through a phishing email, an exposed remote desktop port, or stolen credentials. Once inside, the malware moves quietly across the network for days or weeks, identifying valuable files and disabling backup systems before triggering the encryption. By the time the ransom note appears on screen, the damage is already done.
Modern ransomware groups also practise "double extortion": they exfiltrate a copy of the data before encrypting it. If the victim restores from backup and refuses to pay, the attacker threatens to publish the stolen files. This tactic has made backups alone an incomplete defence.
Payment is almost always demanded in cryptocurrency, which is harder to trace. Even businesses that pay have no guarantee of getting a working decryption key. The CISA StopRansomware initiative advises against paying ransoms, noting that payment funds future attacks and doesn't guarantee data recovery.
Who gets targeted and why
Attackers choose targets based on two things: perceived ability to pay and perceived weakness of defences. Healthcare providers, law firms, manufacturers, and logistics companies are frequent targets because downtime is acutely costly for them, which raises the pressure to pay quickly. Small businesses are targeted precisely because they're less likely to have dedicated security staff or tested incident response plans.
The entry point is usually people, not technology. Phishing emails that impersonate suppliers, HR departments, or cloud service providers are still the most common initial access method. This is why understanding how phishing attacks work is directly relevant to ransomware defence, not a separate topic.
Practical steps to protect your business
Ransomware defence works in layers. No single control stops every attack, but combining several makes it much harder for an attacker to reach the encryption stage.
- Offline and offsite backups. Keep at least one backup that is not connected to your main network. Test restore procedures quarterly. If the backup is reachable from the network, ransomware can encrypt it too.
- Multi-factor authentication (MFA). Enable MFA on every internet-facing service, starting with email and remote access tools. Stolen credentials are useless to an attacker who can't pass the second factor.
- Patch regularly. Ransomware groups actively exploit known software vulnerabilities. Apply operating system and application patches within 72 hours of a critical release.
- Restrict remote desktop access. RDP (Remote Desktop Protocol) is one of the most common entry points. If your team doesn't need it exposed to the internet, disable it. Where it's needed, place it behind a VPN.
- Segment your network. If ransomware lands on one machine, network segmentation limits how far it can spread. Finance systems and production servers should not be reachable from every endpoint on the network.
Staff training matters as much as technical controls. An employee who can spot a suspicious email attachment is a genuine line of defence. Pair training with simulated phishing exercises to make it stick.
Securing cloud accounts and email
A large share of ransomware attacks now start through compromised cloud accounts rather than on-premises systems. Email platforms, file storage, and collaboration tools are common entry points. Securing your Microsoft 365 account specifically reduces the risk of an attacker using your email platform as a launchpad into the rest of your environment.
Conditional access policies, login alerts for unrecognised locations, and disabling legacy authentication protocols are three settings that pay immediate dividends. Most businesses that get compromised through cloud accounts had at least one of these left in its default state.
What to do if ransomware hits
Speed matters. The first step is isolation: disconnect affected machines from the network immediately to slow the spread. Don't turn the machines off, because forensic investigators may need the memory state to identify the malware variant and assess what was accessed.
Contact your IT provider or incident response team before attempting any recovery. Report the attack to the Australian Cyber Security Centre (ACSC) at cyber.gov.au. Reporting helps authorities track ransomware groups and may surface intelligence that assists your recovery.
Check whether a free decryption tool exists before paying anything. The No More Ransom project maintains a library of decryptors for dozens of ransomware strains. If your backups are intact and isolated, restore from them. Document everything: incident reports are required if the attack involves a notifiable data breach under the Privacy Act.
Building a resilient posture, not just a checklist
Ransomware defence isn't a one-time project. Attackers adapt, and so should your controls. Review your small business cybersecurity checklist at least annually, and after any significant change to your infrastructure, such as moving to new cloud services, adding remote workers, or acquiring another business.
Cyber insurance has also become a relevant part of the picture for businesses that handle sensitive client data or rely on continuous uptime. Insurers increasingly require evidence of specific controls (MFA, tested backups, endpoint detection) before they'll write a policy. Meeting those requirements also happens to be good security practice.
The core idea is straightforward: ransomware is a business problem, not purely a technical one. The decisions that determine whether an attack succeeds are often made months before the ransom note appears.