What happens if your business gets ransomware?

Ransomware is a significant and persistent threat to UK small and medium-sized enterprises. It is no longer a niche concern for large corporations; businesses of all sizes are targeted. This malicious software encrypts your critical files, rendering your operational data inaccessible until a ransom, typically demanded in untraceable cryptocurrency, is paid. For an SME, this isn't merely an inconvenience; it's a direct assault on your ability to trade. When your essential data is locked away, productivity ceases, your reputation is damaged, and your legal obligations under UK GDPR become a pressing issue. Understanding the mechanics of a ransomware attack and knowing the immediate, practical steps to take can be the difference between a temporary disruption and irreversible business failure.

What ransomware actually means

At its core, ransomware is a digital extortion scheme. It's a type of malware designed to deny you access to your own data. An attacker gains entry to your network, often through a phishing email or an unpatched vulnerability. Once inside, the ransomware rapidly encrypts files on your computers and connected network drives. This process scrambles your data, making it unreadable without a unique decryption key. Following encryption, a ransom note appears, typically a text file or an altered desktop background, instructing you on how to pay the attackers to supposedly regain access. Payment is almost always demanded in cryptocurrency, primarily Bitcoin, due to its pseudonymous nature. The objective is simple: incapacitate your business operations until you pay up.

Why it matters for UK SMEs

The commercial implications of a ransomware attack for a UK SME are profound and far-reaching. Beyond the immediate operational standstill, there are significant financial and reputational costs. Lost revenue from downtime, potential fines from the Information Commissioner's Office (ICO) for data breaches, and the cost of recovery can easily bankrupt a smaller business. The National Cyber Security Centre (NCSC) consistently advises against paying ransoms, highlighting the risk of non-decryption and the funding of further criminal activity.

Under the UK General Data Protection Regulation (UK GDPR), if a ransomware attack involves a personal data breach that poses a risk to individuals' rights and freedoms, you are legally obliged to report it to the ICO within 72 hours of becoming aware. Failure to do so can result in substantial penalties. Furthermore, customers and suppliers will lose trust if their data is compromised or your services become unreliable. Adopting frameworks like Cyber Essentials, a UK government-backed scheme, provides a recognised baseline of technical controls that can defend against the majority of common cyber threats, including many ransomware variants. Ignoring these realities is, frankly, irresponsible.

How to respond to ransomware, a practical walkthrough

Responding to a ransomware incident requires a calm, methodical approach. Panic leads to poor decisions. Your immediate actions will significantly influence the outcome.

The Immediate Impact: What You Will Experience

When ransomware strikes, the initial signs are often subtle. Employees might report difficulty opening files, applications crashing, or strange, unrecognisable file extensions appearing in their folders. The encryption process can take time, during which the malware spreads. Once complete, the ransom note will appear, detailing the attacker's demands and payment instructions.

The operational paralysis is immediate and total. You will lose access to critical business systems: your customer relationship management (CRM) software, financial ledgers, email archives, client databases, and even basic file shares. For many UK businesses, this means an inability to process orders, issue invoices, manage stock, or communicate effectively with customers and suppliers. The psychological toll on your team is also significant; staff members, unable to perform their duties, often experience high levels of stress and anxiety, which can further impede rational decision-making.

Step 1: Containment and Isolation

The moment a ransomware infection is suspected, your absolute priority is to stop its spread. Ransomware is engineered to move laterally across your network, encrypting shared drives, connected devices, and attempting to compromise backups.

• Disconnect from the network: Immediately unplug the Ethernet cable from any suspected infected machine. If the machine is connected via Wi-Fi, disable the wireless adapter. Do this for all affected devices as quickly as possible.
• Isolate the segment: If your IT infrastructure is segmented (e.g., different VLANs for servers, workstations, guest networks), disconnect the affected segment or VLAN from the rest of the company network. This prevents further lateral movement to critical servers or other departments.
• Do not power off (unless instructed): While it feels counter-intuitive, completely shutting down a machine can wipe volatile memory (RAM), which may contain crucial forensic data or even the encryption keys needed for recovery. Disconnect it from the network and leave it running, awaiting professional guidance. However, if you have no immediate professional support and the ransomware is clearly spreading rapidly, powering off might be a necessary last resort to contain the damage.
• Notify your Managed Service Provider (MSP): If you partner with a firm like Black Sheep Support, alert our emergency response team immediately. We can initiate a remote lockdown of your network, deploy advanced detection tools, and guide you through the initial containment steps to prevent the malware from reaching your critical servers or off-site backups.

Step 2: The Assessment and Legal Obligations

Once the environment is contained, a thorough assessment of the damage is required. You need to identify precisely which machines are encrypted, the extent of the data loss, and crucially, whether sensitive personal data has been exfiltrated.

Under the UK General Data Protection Regulation (UK GDPR), if the ransomware attack resulted in a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, you have a legal obligation to report the incident to the Information Commissioner’s Office (ICO) within 72 hours of becoming aware of it. This timeframe is strict.

Your legal and ethical checklist

• Document everything: Maintain a meticulous log of events. Record when the attack was discovered, the specific steps taken to contain it, the systems affected, and all communications with staff, suppliers, and external advisors. Screenshots of ransom notes or unusual file structures can be useful.
• Check for data exfiltration: Modern ransomware groups frequently employ a "double extortion" strategy. They don't just encrypt your data; they also steal a copy and threaten to publish it on the dark web if the ransom isn't paid. You must determine if your customer, employee, or sensitive company data has been compromised in this manner.
• Consult legal counsel: If sensitive data is involved, engage with your cyber-insurance provider or a legal firm specialising in data protection immediately. They can help you navigate the complex regulatory reporting requirements and advise on potential communication strategies with affected parties.

Step 3: To Pay or Not to Pay?

The decision to pay a ransom is perhaps the most difficult a business owner will face. The UK government, the National Cyber Security Centre (NCSC), and law enforcement agencies like the National Crime Agency (NCA) consistently and strongly advise against paying ransoms.

Why payment is a dangerous gamble

• No guarantee of recovery: Paying the ransom does not guarantee that the cybercriminals will provide a working decryption tool. Attackers are not always honourable, and the tools they provide are often unreliable, incomplete, or introduce further malware.
• You become a target: Businesses that pay are often marked by criminal groups as "willing payers," making them prime targets for future attacks. You demonstrate a willingness to comply, which is attractive to further extortion attempts.
• Funding criminal activity: Your payment directly funds sophisticated criminal enterprises, enabling them to develop more advanced malware and target more businesses, perpetuating the cycle of cybercrime.
• Legal risks: Depending on the specific threat actor, paying a ransom could potentially violate UK sanctions laws if the group is linked to restricted regimes or sanctioned entities. This is a complex area where legal advice is essential.

Instead of paying, focus your resources on clean restoration from immutable backups – backups designed to be unalterable and undeletable by ransomware.

Step 4: The Recovery Process

Recovery is a methodical, multi-stage process. You cannot simply restore a backup to the same environment that was just compromised, as the attackers may have left "backdoors" (hidden access points) waiting to trigger a second wave of encryption.

The "Clean Room" restoration strategy

1. Sanitise the environment: Wipe the infected hardware entirely. This means completely erasing hard drives and reinstalling operating systems from known-good, original sources. Do not simply restore an image of the compromised system.
2. Patch all vulnerabilities: Before bringing any systems back online, ensure all operating systems, applications, firewalls, and network devices are patched to the very latest versions. The attackers exploited a vulnerability to get in; you must close that door. This includes reviewing remote access points like RDP.
3. Restore from verified backups: Use the most recent "clean" backup. This is where the quality of your backup strategy becomes paramount. You must ensure the backup itself is free of malware and hasn't been compromised. This often involves restoring to a segregated, clean environment first for testing. On a recent client tenant audit, we found 2 out of 5 critical line-of-business application backups for a Surrey-based logistics firm with 25 staff were corrupted and unusable, a discovery made before an incident. This highlights the critical need to regularly test your backups, not just assume they work.
4. Reset all credentials: Assume all passwords, service accounts, and administrative keys have been compromised. Force a company-wide password reset. Crucially, implement Multi-Factor Authentication (MFA) on every single account – administrator, user, and service accounts – to prevent attackers from re-entering with stolen credentials.

Step 5: Building Resilience for the Future

After the immediate crisis subsides, the focus must shift to hardening your defences. Cyber Essentials provides an excellent framework for this. Achieving Cyber Essentials or Cyber Essentials Plus certification ensures you have the baseline technical controls to protect your SME against the vast majority of common cyber threats.

• Immutable Backups: Ensure your backups are stored off-site, ideally in a separate cloud tenancy or air-gapped from your primary network. Implement versioning and retention policies that protect against ransomware deleting or encrypting your backup sets.
• Endpoint Detection and Response (EDR): Move beyond traditional antivirus. EDR solutions continuously monitor activity on your endpoints (laptops, servers), identifying and stopping malicious behaviour as it happens, rather than just relying on signature-based detection.
• Staff Training: The most common entry point for ransomware is a phishing email. Regular, realistic phishing simulations and comprehensive cyber awareness training ensure your employees are your strongest line of defence, not your weakest link.

Common mistakes we see

1. Untested Backups: Many businesses assume their backups work, only discovering they are corrupted, incomplete, or unrecoverable when a ransomware attack hits.
2. No Multi-Factor Authentication (MFA): Relying solely on passwords leaves accounts vulnerable to credential theft, a primary vector for ransomware attacks.
3. Inadequate Incident Response Plan: Without a clear, documented plan, businesses often react chaotically, exacerbating the damage and slowing recovery.
4. Poor Patch Management: Unpatched software and operating systems provide easy entry points for attackers, allowing ransomware to exploit known vulnerabilities.
5. Over-reliance on Basic Antivirus: Traditional antivirus is often insufficient against modern, sophisticated ransomware strains that are designed to evade signature-based detection.

Key Takeaways

• Ransomware is an operational emergency: Treat it with the same urgency and planning as any critical business disruption.
• Containment is priority one: Isolate infected systems immediately to prevent further spread across your network.
• Do not pay the ransom: Payment is a dangerous gamble that rarely guarantees recovery and fuels further criminal activity.
• Regulatory compliance is mandatory: Be aware of your 72-hour window for reporting personal data breaches to the ICO.
• Prevention is cheaper than recovery: Proactive investment in robust backups, MFA, EDR, and Cyber Essentials certification will cost a fraction of a ransomware recovery.

When to call in help

Navigating a ransomware attack is exceptionally complex. It demands specialised technical knowledge, forensic capabilities, and an understanding of legal and regulatory obligations that most SMEs do not possess in-house. Attempting to manage such a crisis alone often leads to greater data loss, longer downtime, and increased costs. Having a trusted IT partner with a pre-defined incident response plan ensures you have expert guidance and resources ready before a crisis hits. Frankly, you wouldn't attempt to put out a serious office fire without calling the fire brigade. This is no different.

To take the next step

Book a Discovery Call