Ransomware in small and mid-sized companies: how to protect your business

What ransomware is

Ransomware is a type of attack in which the criminal breaks into the network, encrypts files and systems and demands a payment, usually in cryptocurrency, to restore access. In recent years, groups have started to copy the data before encrypting it and threaten to publish it. This is known as double extortion: even companies with backups are still under pressure.

Small and mid-sized companies have become a preferred target for a simple reason: they usually have fewer layers of protection, nobody dedicated to security, and they depend entirely on their systems to bring in revenue. One day of downtime already hurts; a week can be fatal.

Nobody is too small
Most attacks are automated. Criminals look for known flaws and leaked passwords across thousands of companies at the same time, regardless of size or industry.

How the attack happens, step by step

1. Initial access
   A phishing email with a link or attachment, a leaked password used for remote access (a VPN or RDP exposed to the internet) or an unpatched flaw in a server or firewall.
2. Reconnaissance
   Once inside the network, the attacker maps servers, file shares and accounts with administrator privileges. This phase can last days without anyone noticing.
3. Data theft
   Customer, finance and HR files are copied out. This is the material for the second extortion.
4. Sabotaging the backups
   Before the final strike, the criminal deletes or encrypts any backup copies that can be reached over the network.
5. Encryption and extortion
   The files are encrypted all at once and the ransom note appears, with a deadline and the threat of a leak.

Warning signs that need immediate attention

• New administrator accounts or logins at unusual hours.
• Antivirus or EDR switched off with no explanation.
• Large volumes of data leaving the network, especially at night.
• Remote access or file compression tools installed without a request from IT.
• Files with strange extensions or that won’t open.

The 8 measures that reduce the risk the most

• Two-factor authentication (MFA)
  On email, VPN, remote access and administrator accounts. A leaked password is no longer enough.
• Up-to-date systems
  Operating systems, servers, firewall and VPN kept up to date. Known flaws are the most exploited way in.
• 3-2-1 backup with an offline copy
  Three copies, on two types of media, one off the network or immutable. And restores tested regularly.
• Least privilege
  Nobody uses an administrator account day to day. Access is reviewed whenever someone changes roles or leaves.
• EDR on every machine
  Detection and response that recognizes attack behavior and isolates the machine automatically.
• Nothing exposed without need
  Remote access only through a VPN with MFA. Ports such as RDP are never opened directly to the internet.
• Trained people
  Phishing simulations and practical guidance. An alert employee is a layer of defense.
• A response plan ready to go
  Who decides, who gets called and what to do in the first hour, defined before there is a problem.

If it happens: what to do in the first few hours

1. Isolate, don’t shut down
   Disconnect the affected machines from the network (cable and Wi-Fi). Shutting them down can erase evidence that helps explain the attack.
2. Trigger incident response
   Call your security team or partner. Don’t let each person try to fix it on their own.
3. Preserve the evidence
   Take a photo of the ransom note, don’t delete files and write down everything you observed, with the time.
4. Check the backups
   Make sure the offline copies are intact before any restore.
5. Notify those who need to know
   If personal data is involved and there is a relevant risk to the people affected, Brazil’s data protection authority (ANPD) must be notified within 3 business days (ANPD Resolution No. 15/2024). File a police report as well.

Does paying the ransom solve it?
There is no guarantee that the key will work or that the stolen data will be deleted. Paying also funds new attacks. If the decision ever comes up, it must involve the board, legal counsel and specialists.

Quick checklist for your company

• MFA enabled on email, VPN and administrator accounts
• Servers, firewall and workstations up to date
• Backup with an offline or immutable copy
• Restore tested in the last 3 months
• EDR installed on workstations and servers
• No remote access exposed directly to the internet
• Phishing training or simulation in the past year
• Documented incident response plan