Ransomware is malicious software that encrypts or locks a business's files and systems so they cannot be used, followed by a demand for payment in exchange for a decryption key. Many attacks now also copy data before encrypting it, then threaten to publish it. For a small or medium-sized business, that can mean days without access to accounting files, customer records or shared drives.
Attackers usually get in first, look around, take what they can and only then trigger encryption across as many machines as possible. That gives defenders several chances to stop it.
How ransomware usually gets in
- Phishing emails: a malicious attachment or a link to a fake login page gives the attacker a foothold on a staff account or laptop.
- Exposed remote access: Remote Desktop (RDP), VPNs or remote-support tools reachable from the internet, especially with weak passwords or no second factor.
- Unpatched systems: known vulnerabilities in firewalls, VPN appliances, servers, websites or plugins that have fixes available but have not been applied.
- Stolen or reused passwords: credentials leaked from another service, guessed, or captured by phishing, then used to sign in as a real user.
What double extortion means
With double extortion, attackers copy data out first, such as customer details, contracts or HR files, and then demand payment both to restore access and to not publish what they took. Good backups therefore do not remove all the risk: even if you restore your systems, the stolen data may still be exposed.
How to reduce the risk
No single tool stops ransomware. These steps make entry harder, limit spread and make recovery possible.
- Patch promptly: keep operating systems, firewalls, VPNs, servers and web software up to date, starting with anything exposed to the internet. See patch management.
- Turn on multi-factor authentication: require MFA for email, remote access, cloud admin consoles and finance systems, so a stolen password is not enough.
- Close or protect remote access: do not leave RDP open to the internet; put remote access behind a VPN or gateway with MFA, and remove accounts that are no longer needed.
- Use strong, unique passwords: a password manager makes this practical for staff.
- Apply least privilege: give people and service accounts only the access they need, and keep admin rights separate from everyday accounts. Role-based access control and a zero trust approach help limit how far one compromised account can reach.
- Keep offline or immutable backups: keep at least one copy of important data that ransomware cannot reach or change, such as a disconnected drive or a backup service with immutability or version locking, and test restores regularly. A backup that has never been restored is an assumption, not a plan.
- Filter email: use the filtering in your email platform to block malicious attachments and links, and set up SPF, DKIM and DMARC to make spoofing your domain harder.
- Train staff: short, regular reminders on spotting phishing, and a clear, blame-free way to report a suspicious email or a mistaken click quickly.
- Test your defences: a penetration test can show which systems are exposed before an attacker finds them.
What to do if you are hit
A simple written plan, agreed in advance, helps people act calmly in the first hours.
- Isolate affected devices: disconnect them from the network (unplug the cable, turn off Wi-Fi) to slow the spread. Avoid switching everything off without advice, as some evidence may be lost.
- Do not wipe or rebuild yet: keep ransom notes, logs and affected machines as they are until your IT provider or incident responder has looked at them.
- Contact your IT provider: they can help confirm the scope, check whether backups are intact and plan a clean restore.
- Change credentials from a clean device: reset passwords for email, admin and remote-access accounts, and review MFA settings.
- Report it: report the incident to the Hong Kong Police Force, and consider contacting HKCERT for guidance. Use the contact details published on their official websites.
- Check personal data obligations: if personal data may have been accessed, ask your legal or compliance advisers whether to notify the Office of the Privacy Commissioner for Personal Data (PCPD) and affected individuals.
Frequently asked questions
Should we pay the ransom?
Law enforcement and security agencies generally advise against paying. Payment does not guarantee that you will receive a working decryption key, that stolen data will be deleted, or that you will not be targeted again. Discuss any decision with your incident responder and advisers rather than negotiating alone.
Does cloud storage protect us from ransomware?
Not automatically. Synced folders can upload encrypted files and overwrite good copies, and an attacker with your cloud admin login can delete data. Check whether your service offers version history or retention you can restore from, protect admin accounts with MFA, and still keep a separate backup.
Is antivirus enough?
Endpoint protection helps, but attackers often use stolen logins and legitimate tools that antivirus may not flag. It works best alongside patching, MFA, least privilege and tested backups.
Are small businesses really targeted?
Many attacks are opportunistic: automated scans look for any exposed remote access or unpatched system, whatever the size of the company. Smaller firms can be attractive because they often have fewer defences.
If you would like help reviewing your exposure, backups and response plan, see our cybersecurity and compliance services.