Ransomware is malicious software that locks your files — usually by encrypting them — and demands payment for the key. It arrives like any other phishing email: an invoice attachment, a parcel notification, a resume. One click, one file opened, and the encryption spreads quietly to every drive and network share the infected computer can reach, ending in a ransom note where your spreadsheet used to be. Verizon's 2025 Data Breach Investigations Report finds ransomware present in roughly four in ten breaches at small and medium businesses (Verizon 2025 DBIR) — and attackers favour small businesses precisely because most have no tested recovery plan. This guide explains how ransomware actually gets in, what to do in the first hour, and the training that stops most attacks before they start.
TL;DR
- Ransomware encrypts your files and demands payment; it almost always starts with a phishing email or stolen credentials.
- Small businesses are the target of choice: limited IT budgets, no tested backups, and the assumption that “too small to bother”.
- The first-hour checklist: isolate the infected device, disconnect shared drives, preserve evidence, report to ReportCyber — do not pay without expert advice.
- Offline, tested backups are the only recovery that does not depend on the attacker's honesty.
- Training is the cheapest prevention: most ransomware starts with one person clicking one phishing email (what is phishing?).
How ransomware gets in
The door is almost never forced; it is opened from inside:
- Phishing email. The dominant entry: an attachment (invoice, shipping notice, \u3010voicemail\u3011 audio file) or a link to a fake login. One click on an infected attachment is enough.
- Stolen credentials. Attackers buy passwords from other breaches, log into remote access tools (VPN, remote desktop) and deploy ransomware manually — no click required (credential stuffing is how this usually starts).
- Software vulnerabilities. Unpatched systems with known flaws give attackers the foothold — especially remote access and edge devices.
- Malvertising and fake software. Search ads for popular software that deliver trojanised installers.
Once inside, the attacker typically waits: mapping your network, finding backups, escalating access. The encryption event is the finale of a breach that may have run for days — which is why the signs (locked files, odd file names, computers running slow) matter less than the habits that catch the entry attempt days earlier.
What to do in the first hour
- Isolate. Disconnect the infected device from the network (unplug the cable, turn off Wi-Fi). Every minute connected lets encryption spread to shared drives.
- Cut lateral paths. Switch off shared drives, and if multiple machines are affected, disconnect them all — or the whole network if the spread is fast.
- Preserve, do not destroy. Do not wipe or reimage anything: the encrypted files, ransom note and event logs are evidence and may allow decryption later.
- Call for expert help early. An incident-response provider (or your IT provider's escalation path) before any ransom conversation.
- Report it. ReportCyber (cyber.gov.au) coordinates with police and banks; your insurer likely requires it.
- Do not pay without advice. Payment funds the next attack, offers no guarantee of a working key, and marks you a payer for future attacks. In Australia, paying a ransom for certain critical infrastructure is restricted — check current guidance.
After the immediate crisis: reset all credentials (attackers steal passwords before encrypting), close the entry point, and patch the vulnerability that let them in.
Why small businesses are the new favourite target
- Ransom amounts are small enough to pay. Attackers price to what a 20-person business will pay rather than argue about.
- Backups exist on the same network. Attached and always-on backups get encrypted too — the failure that turns an inconvenient attack into an extinction event.
- No rehearsal. The first time most small businesses think about ransomware is the ransom note — when panic is expensive and options are few.
- One person's click is a whole-company event. Without network segmentation, one laptop can take down the file server, the accounting system and the backups in a morning.
ACSC's Essential Eight mitigation strategies (application control, patching, restricting macros, MFA, backups) are built precisely for this threat and map closely to what a gap assessment will surface in a small business.
The defences that actually hold
- Backups that ransomware cannot reach. The 3-2-1 rule: three copies, two media types, one offline or immutable. A backup you can restore in hours is the difference between a bad morning and a bankruptcy.
- MFA on everything remote. Email, VPN, remote desktop. Most ransomware deployments begin with a stolen password.
- Patch promptly. Especially internet-facing systems and remote access tools.
- Train the click reflex. The entry point is an email; the last line of defence is a trained person. Monthly security awareness training with simulated phishing measurably reduces click rates — and reporting culture means the one click gets reported before the encryption starts.
- Rehearse the response. A one-page plan (who isolates, who calls the bank and ReportCyber, who restores backups) tested twice a year. Human risk reporting shows where the gaps are between drills.
FAQ
What is ransomware in simple terms? Malicious software that locks your files and demands payment for the key. It usually arrives as a phishing email attachment or through a stolen password.
Should we pay the ransom? Generally no: no guarantee of a working key, it funds the next attack, and you become a known payer. Australian authorities advise against payment. Decide only with expert incident-response advice.
Can ransomware spread to backups? Yes — ransomware hunts network-attached and cloud-synced backups. Offline, immutable or air-gapped backups are the only kind that reliably survive.
How do we know if it's ransomware or something else? Ransomware announces itself: files renamed or unreadable, ransom-note files in folders, applications refusing to open. Slowness alone is not ransomware — but treat unexplained file changes as urgent.
Is ransomware a small business problem in Australia? Yes — it is one of the most common and costly incident types reported to the ACSC, and small businesses are targeted because their defences are thin and their recovery plans untested.
One last thing
Ransomware is a phishing email that got through, multiplied across every drive in the business. Backups you can restore, MFA you have turned on, and staff who report the lure instead of clicking it — three habits that turn a potential extinction event into a bad morning.