Ransomware protection for a small business comes down to three phases. Prevent the break-in with multifactor authentication, fast patching, endpoint detection and tight admin rights. Respond in the first hours by isolating machines, calling your IT team and reporting to the FBI. Recover from backups the attacker could not reach, so paying never becomes the only option.
This guide walks through each phase in plain terms. It is written for owners and office managers of companies with five to two hundred people, the size of business that rarely has a security team but still holds client files, payroll data and bank access that criminals want.
Why ransomware gangs go after small businesses
Small businesses are targets because they pay, they recover slowly, and their defenses are often thin. The FBI's 2025 Internet Crime Report counted 3,611 ransomware complaints in 2025, up from 3,156 in 2024. More than 1,400 of those came from businesses outside the critical infrastructure sectors. Legal services such as law firms led that group at 18 percent, followed by contracting services at 17 percent and engineering and architecture firms at 10 percent. These are ordinary local companies, not multinationals.
The same report lists the variants reported most often in 2025, led by Akira, Qilin, INC/Lynx/Sinobi, BianLian and Play. Reported ransomware losses topped $32 million, but the FBI warns that figure is artificially low, because it leaves out lost business, staff time, equipment and outside cleanup costs, and many victims report no loss amount at all. California, the largest state, also topped every state for complaint count and reported losses across all internet crime types.
How a ransomware attack unfolds, step by step
A ransomware attack is a process that runs for days or weeks before the ransom note appears, which is good news, because every stage is a chance to catch it. Understanding the business model behind it explains why the stages look the same from one victim to the next.
Ransomware as a service
Many attacks today come from a franchise model called ransomware as a service, or RaaS. One group builds the encryption software, the payment site and the leak site. It then rents that kit to affiliates who do the breaking in, and both sides split the ransom. Some criminals specialize only in getting a foothold and sell that access to affiliates, which is why one stolen password can lead to an attack months later by someone else entirely.
Double extortion and the leak threat
Early ransomware simply locked files. Many groups now steal a copy of your data first, then encrypt. If you restore from backups and refuse to pay, they threaten to publish client records, contracts or medical files. Some add pressure by flooding your website with traffic or by contacting your clients and staff directly. This is why backups alone do not end the problem, and why a ransomware incident is often a data breach with legal notice duties.
| Stage | What the attacker does | What stops it |
|---|---|---|
| Initial access | Uses a phishing email, a stolen or reused password, an unpatched firewall or VPN, or exposed remote desktop | MFA, patching, email filtering, closing exposed remote access |
| Foothold and spread | Installs remote control tools, collects admin passwords, moves from one PC to the servers | Endpoint detection and response, least privilege, network segmentation |
| Data theft | Copies files out to servers it controls | Monitoring for unusual outbound traffic, keeping less sensitive data |
| Backup sabotage | Finds and deletes or encrypts every backup it can reach | Offline or immutable backups with separate credentials |
| Encryption and extortion | Locks files, leaves a ransom note, threatens to leak the stolen data | A practiced response plan and a tested restore |
Phase 1: Prevent the attack with controls that block most entry points
The cheapest ransomware attack is the one that never gets in. The joint CISA, MS-ISAC, NSA and FBI #StopRansomware Guide and the FBI's own recommendations in its annual report point to the same short list of controls. None of them is exotic, and most small businesses can put them in place in weeks, not months.
| Control | What it blocks | Federal guidance |
|---|---|---|
| MFA on email, VPN, remote access and admin accounts | Logins with stolen passwords | FBI asks for MFA on all services where possible; CISA asks for phishing-resistant MFA |
| Patching, internet-facing systems first | Exploits of known flaws in firewalls, VPNs and servers | Both prioritize known exploited vulnerabilities on internet-facing systems |
| Endpoint detection and response (EDR) | Remote control tools and lateral movement | FBI calls EDR particularly useful for spotting lateral connections |
| Least privilege and separate admin accounts | An attacker turning one user login into full control | FBI asks for audited admin accounts and least privilege; CISA asks for separate admin and user accounts |
| Network segmentation | Spread from one PC to every server | Both recommend segmenting networks |
| Email filtering and staff training | Phishing links and malicious attachments | CISA recommends gateway filtering and user training |
Multifactor authentication everywhere a password works
Turn on MFA for email, remote access, banking, your accounting software and every admin account. Stolen and reused passwords are a common way in, and MFA blocks a login that has only the password. For owners, bookkeepers and IT admins, move past text message codes to app prompts with number matching, or better, passkeys and security keys. Our guide to phishing-resistant MFA explains which methods hold up when an attacker builds a fake login page.
Patching that starts at the edge of your network
The FBI calls timely patching one of the most efficient and cost-effective steps an organization can take. Start with anything reachable from the internet: the firewall, the VPN, remote desktop gateways, file transfer tools and any server with a public address. Then cover Windows, macOS, browsers and the third-party apps staff use daily. Set a rule that critical fixes for internet-facing systems go in within days, not at the next monthly window.
Endpoint detection with someone watching the alerts
Old antivirus looks for known bad files. Modern attackers often use legitimate admin tools instead, so signature matching misses them. Endpoint detection and response watches behavior, such as a laptop suddenly scanning the network or a script trying to delete backup copies, and can isolate the machine automatically. The tool only helps if a person reviews what it flags, including at night and on weekends. That is the job of threat detection and response: alerts reach a human who can act.
Least privilege and segmentation to limit the blast radius
Give each person access only to the folders and systems their job needs. Nobody should browse the web or read email while logged in as an administrator, so admins get a separate account for admin work. Remove accounts for former staff and old vendors the day they leave. Then split the network so guest Wi-Fi, office PCs, servers, cameras and phones sit in separate zones. If one laptop is compromised, segmentation keeps the attacker from walking straight to the file server and the backup system.
Email filtering and staff who report quickly
Filtering catches a large share of phishing before anyone sees it. CISA also recommends blocking risky attachment types and disabling macros in Office files that arrive by email. Short, regular training then teaches staff to spot what gets through and, just as important, to report a bad click right away. A two-minute report can be the difference between one cleaned laptop and a locked network, so make reporting easy and never punish an honest mistake.
Phase 2: Respond in the first 24 hours
The first day decides how bad a ransomware incident gets. The goal is to stop the spread, keep evidence intact and bring in the right people quickly. A written incident response plan, printed and stored outside your network, means nobody has to invent these steps while the screens are locked.
| When | Action | Why it matters |
|---|---|---|
| First minutes | Disconnect affected machines from the network: unplug the cable, turn off Wi-Fi. If many systems are hit, take the network offline at the switch. | Stops the spread. CISA advises powering devices off only if you cannot disconnect them, because shutdown erases evidence in memory. |
| First hour | Call your IT provider or incident response team. Move all coordination to phones and personal channels. | Attackers inside the network may be reading company email and chat. |
| First hour | Call your cyber insurer's claims line if you have a policy, before hiring outside firms. | Many policies set conditions on notice and on which responders you use. Read yours now, not then. |
| First hours | Photograph the ransom note. Do not wipe, reimage or restore anything yet. Do not contact the attackers. | Investigators need the evidence, and some variants have free decryptors. |
| Same day | Report to the FBI through IC3 or your local field office, and consider asking CISA for help. | Federal partners may know the variant, and early reporting counts in your favor with OFAC. |
| Hours 6 to 24 | Find the entry point and the scope: which systems, which accounts, what data left. Reset passwords from a clean device. | Restoring before you close the door invites the attacker straight back in. |
| Day one and after | Bring in legal counsel about notice duties, then restore in priority order from clean backups. | Stolen personal information can trigger California's 30-day notice deadline. |
For the full hour-by-hour playbook, including what to say to staff and clients, see our guide to ransomware incident response.
Should a small business pay the ransom?
No, not as a plan, and never without counsel and law enforcement involved. The Treasury Department's Office of Foreign Assets Control (OFAC) says in its September 21, 2021 updated advisory on ransomware payments that the U.S. government strongly discourages paying, and that payment brings no guarantee you will get your data back or avoid another attack. The FBI's position, stated in a public service announcement on high-impact ransomware, is that it does not advocate paying a ransom.
There is also legal risk. If the group behind the attack is on a sanctions list, a payment can violate federal sanctions law, and OFAC can impose civil penalties on a strict liability basis, meaning you can be liable even if you did not know who you were paying. OFAC treats a prompt, complete report to law enforcement and full cooperation as significant mitigating factors. The practical lesson is simple: report early, and build backups good enough that the question never comes up.
Who to report to, and when California law requires notice
Report the attack to the FBI by filing at ic3.gov or by calling your local FBI field office. CISA's StopRansomware hub also accepts reports and requests for technical help. Include the ransom note, any attacker email addresses or chat links, wallet addresses and a timeline of what you saw.
If attackers took personal information about California residents, state law adds a deadline. Under California Civil Code section 1798.82, as amended by SB 446, notice to affected residents must go out within 30 calendar days of discovering the breach, starting January 1, 2026. Delay is allowed for law enforcement needs or to determine the scope and restore the system. If more than 500 Californians need notice, a sample copy goes to the Attorney General within 15 calendar days of notifying them. Our guide to California data breach notification law covers what counts as personal information and what the notice must say.
Phase 3: Recover without paying
Recovery without paying depends on one thing: a clean, recent copy of your data that the attacker could not touch. Ransomware crews look for backups early, because a victim who can restore has no reason to pay. Any backup that the same admin password can reach is part of the same target.
Backups the attacker cannot reach
Start with the 3-2-1 backup rule: three copies of your data, on two different types of storage, with one copy offsite. Then add a ransomware layer. At least one copy should be offline or immutable, and the restore should be tested. The FBI asks for backups that are encrypted, immutable and cover the whole organization. CISA asks for offline, encrypted backups that are tested regularly, plus saved clean images of key systems so you can rebuild fast.
Immutable means the backup cannot be changed or deleted during its retention period, even by someone holding an administrator password. Our article on immutable backups explains how this works in cloud storage and backup appliances. Keep the backup system's logins separate from your everyday network accounts, protect them with MFA, and alert on any attempt to shorten retention or delete restore points.
Recovery targets to set before you need them
Two numbers shape your backup design, and the owner should choose them, not the IT vendor. Write them down for each key system.
| Term | Plain meaning | Question to answer |
|---|---|---|
| Recovery point objective (RPO) | How much recent work you can afford to lose | If we restore last night's copy, can we live without today's entries? |
| Recovery time objective (RTO) | How long a system can be down before the business is badly hurt | How many hours can we run without email, files or the accounting system? |
| Restore priority | The order systems come back | What do we need first to serve clients and get paid? |
| Last tested restore | Proof the backup actually works | When did we last restore a full system, and how long did it take? |
Restoring clean, not just restoring fast
A rushed restore can bring the attacker back with it. CISA's guide says to rebuild systems from clean images, reset passwords and fix the gap that let the attacker in before reconnecting. In practice, restore into an isolated network first, scan the data, confirm that hidden remote access tools are gone, then bring systems back in priority order. Our ransomware data recovery guide lays out a realistic recovery timeline and what slows it down.
Cloud services help here, with one caution. A cloud provider keeps its own infrastructure running, but your accounts, settings and data are still yours to protect, so check what your provider actually restores and for how long. A managed disaster recovery setup can replicate key servers to a separate environment, so the business can run there while the office network is rebuilt.
A 30-day starting plan for a small business
If this list feels long, sequence it. These four weeks cover the controls that matter most, and none needs a large budget.
| Week | Focus | Done means |
|---|---|---|
| Week 1 | Accounts and access | MFA on email, remote access, banking and admin accounts; old accounts removed; admins use separate logins |
| Week 2 | Exposure and patching | A list of everything reachable from the internet; firewall, VPN and servers fully patched; unused remote access closed |
| Week 3 | Backups | One copy offline or immutable; backup logins separated; one full restore tested and timed |
| Week 4 | Response | A one-page plan with phone numbers, printed; insurer and FBI contacts listed; a 30-minute walkthrough with key staff |
How GlobeVM handles ransomware protection for clients
GlobeVM has supported Los Angeles businesses since 1996, first as Boby Systems and as GlobeVM since 2004. Every client plan includes firewall management, endpoint protection, email filtering and MFA as standard, not as add-ons, and our response time is 15 minutes around the clock. Support is available in English and Farsi. One client put the recovery side this way: "After a ransomware attack, GlobeVM recovered all our data in hours. We are incredibly grateful for their swift and effective response."
The facts in this guide come from the FBI's 2025 Internet Crime Report, the joint #StopRansomware Guide from CISA, MS-ISAC, NSA and FBI, OFAC's 2021 advisory on ransomware payments and California Civil Code section 1798.82. If you want to know where your business stands on all three phases, call GlobeVM at (818) 405-9930 for a ransomware readiness review.