Ransomware is malicious software that encrypts a business’s files and systems, and increasingly steals data too, then demands payment to restore access or keep the data private. It remains one of the most damaging cyber threats facing UK businesses of every size, and most attacks start with something simple: a phishing email, a reused password or a remote access system left exposed.
The short version
- What it is
- Malware that locks or steals your data and demands payment.
- How it gets in
- Phishing emails, stolen passwords and unpatched remote access.
- Best defence
- MFA, patching, monitoring and backups kept separate from your network.
What is ransomware?
Older “encryption viruses” simply locked your files and displayed a countdown demanding payment. Modern ransomware gangs usually go further, using what is often called double extortion:
- Encrypt your files, servers and sometimes backups so the business cannot operate.
- Steal copies of sensitive data before encrypting it.
- Threaten to publish or sell that data unless you pay.
How ransomware gets into a business
Phishing emails and malicious attachments
A fake invoice, delivery notice or shared document tricks a user into opening a file or entering their password. Our guide on how to spot phishing emails explains the warning signs.
Stolen or weak passwords
Attackers log in with passwords leaked in other breaches or guessed by automated tools. Without multi-factor authentication, one reused password can be enough. See our advice on password security.
Exposed remote access and unpatched systems
Remote Desktop, VPNs and firewalls that are open to the internet or missing security updates are a favourite way in. Attackers scan for them constantly and use known vulnerabilities within days of them being published.
Would your backups survive a ransomware attack?
How to protect your business from ransomware
- Turn on multi-factor authentication for email, Microsoft 365, remote access and admin accounts.
- Keep systems patched, especially firewalls, VPNs and anything reachable from the internet. Retire unsupported systems such as Windows 10 without extended updates.
- Never expose Remote Desktop directly to the internet. Put remote access behind a secure gateway with MFA.
- Back up properly. Keep at least one copy offline or immutable so ransomware cannot reach it, and test that you can restore. Read why Microsoft 365 needs external backups.
- Use endpoint detection and 24/7 monitoring so suspicious activity is stopped before files are encrypted. See how our Huntress-backed protection works.
- Limit admin rights so a single compromised account cannot reach everything.
- Train your staff to recognise phishing and report anything suspicious quickly.
- Have a plan. A tested disaster recovery plan cuts downtime dramatically.
What to do if you are hit by ransomware
- Isolate affected devices from the network straight away, but do not switch them off, as evidence may be lost.
- Call your IT support provider immediately so they can contain the attack and check other systems.
- Do not contact the attackers or pay without expert advice. Payment does not guarantee your data back or stop it being leaked.
- Report it to the police and, if personal data is involved, consider whether you must tell the ICO within 72 hours.
- Restore from clean backups once the cause has been found and fixed.
Cortec IT provides cyber security services, monitoring and backup for businesses across Kent, London and the South East from Wilmington, in Dartford, Kent. If you are worried about ransomware or need help right now, talk to our team.
Frequently asked questions
What is ransomware?
Ransomware is malicious software that encrypts a business’s files and systems, and often steals data, then demands payment to restore access or keep the data private.
How does ransomware usually get in?
Most attacks start with a phishing email, a stolen or reused password, or remote access and firewalls that are exposed to the internet or missing security updates.
Should we pay a ransomware demand?
Paying is not recommended. It does not guarantee you will get your data back or that stolen data will not be leaked, and it funds further attacks. Get expert advice first.
Will antivirus alone stop ransomware?
No. Antivirus helps, but you also need MFA, patching, monitoring with endpoint detection and response, and backups that ransomware cannot reach.
How should backups be set up to survive ransomware?
Keep several copies, with at least one offline or immutable and separate from your main network and login accounts, and test restores regularly.
Originally published May 2024. Updated November 2026.
