Ransomware attacks on small businesses are up sharply. Here's how ransomware spreads, what you can do to prevent it, and what to do if you get hit.
Ransomware is no longer just a problem for large corporations. In fact, small and mid-sized businesses have become the primary target for ransomware gangs precisely because they tend to have valuable data but weaker defenses than enterprise organizations.
The average ransom demand for small businesses is now over $200,000 — and that doesn't count the downtime, recovery costs, reputational damage, or the fact that paying the ransom doesn't guarantee you'll get your data back.
Here's what you need to know.
What Is Ransomware?
Ransomware is a type of malware that encrypts your files and demands payment (usually in cryptocurrency) in exchange for the decryption key. Once it's running on your systems, it can spread to shared drives, connected computers, and backups — all within minutes.
Modern ransomware attacks often also exfiltrate your data before encrypting it, giving attackers a second lever: pay up or they'll publish your customer data, financials, or employee records online.
How Ransomware Spreads
Understanding the attack vectors is the first step to blocking them.
Phishing Emails
The most common entry point. An employee receives an email that looks legitimate — an invoice, a shipping notification, a "shared document" from a coworker — and clicks a malicious link or attachment. The malware installs silently and begins spreading.
Remote Desktop Protocol (RDP)
RDP lets you access a computer remotely. Many businesses leave RDP exposed to the internet for convenience. Attackers scan for open RDP ports constantly and use brute-force tools to guess weak passwords. Once in, they have full control of your system.
Unpatched Software
Software vulnerabilities are discovered regularly. When patches are released, attackers start scanning for systems that haven't been updated yet. Unpatched Windows, unpatched VPNs, and outdated browsers are all common entry points.
Malicious Websites and Downloads
Drive-by downloads, fake software updates, and malicious ads can all deliver ransomware to employees who aren't paying attention.
The 3-2-1 Backup Rule: Your Best Defense
Even if ransomware does get in, a solid backup strategy means you don't have to pay the ransom. The 3-2-1 rule is the gold standard:
- 3 copies of your data
- 2 different storage media types (e.g., local drive + cloud)
- 1 copy stored offsite (or air-gapped)
The "offsite" or "air-gapped" copy is critical. Many ransomware variants specifically target connected backup drives and mapped network folders. If your backup is mounted as a drive letter on an infected machine, it will get encrypted too.
Cloud backups with versioning (like Veeam, Acronis, or Datto) protect you because you can roll back to a clean version from before the attack.
Important: Having backups is not enough. You need to test restores regularly. Many businesses discover their backups are broken or incomplete only when they actually need them.
The Security Tools That Matter
Endpoint Detection and Response (EDR)
Traditional antivirus looks for known malware signatures. EDR tools watch for behavior — things like a process suddenly encrypting thousands of files at once. Modern EDR solutions can stop ransomware mid-attack and even roll back changes. CrowdStrike, SentinelOne, and Microsoft Defender for Business are all solid options for small businesses.
Email Filtering
Since phishing is the most common entry point, blocking malicious emails before they reach inboxes is one of the highest-ROI security investments you can make. Microsoft Defender for Office 365 and tools like Proofpoint or Mimecast add AI-powered filtering on top of your email platform.
Multi-Factor Authentication (MFA)
MFA won't stop ransomware directly, but it will stop attackers from using stolen credentials to get into your systems via RDP, VPNs, or cloud services. Enabling MFA on all accounts is one of the single most effective security steps any business can take.
DNS Filtering
DNS filtering blocks connections to known malicious domains before any malware even executes. It's lightweight, inexpensive, and stops a lot of threats before they start. Cisco Umbrella and Cloudflare Gateway are popular options.
Employee Training: The Human Firewall
Technology alone isn't enough. Your employees are both your biggest vulnerability and your best defense when properly trained.
Effective security awareness training should include:
- How to spot phishing emails (urgent language, mismatched sender addresses, unexpected attachments)
- What to do if they accidentally click something suspicious (report immediately — don't wait)
- Why they should never plug in unknown USB drives
- How to verify unusual requests (even from "the boss" via email)
Regular simulated phishing tests — where your IT provider sends fake phishing emails to your staff — are one of the most effective training tools available.
What to Do If You Get Hit
If ransomware strikes:
- Isolate immediately — disconnect affected computers from the network (pull the ethernet cable, turn off Wi-Fi). Do not shut down — preserving memory may help with forensics.
- Call your IT provider — don't try to handle this alone.
- Do not pay the ransom without consulting experts — payment doesn't guarantee recovery and may create legal complications.
- Preserve evidence — law enforcement (FBI, CISA) may be able to help, and some ransomware variants have known decryptors.
- Restore from clean backups — this is why having tested, offsite backups is so critical.
- Determine how they got in and fix it before restoring systems.
Need Help?
TechniWorx helps Chicago-area businesses build layered ransomware defenses — from EDR and email filtering to tested backup strategies. If you're not confident your current setup would survive a ransomware attack, get a free security assessment and let's find out before the attackers do.