Ransomware Has Changed. Here’s What Small Businesses Should Watch For

Ransomware used to be easy to describe: malicious software encrypted the files, and a demand appeared on the screen. That still happens, but it is no longer the whole story. Criminal groups often steal information first, look for access to email and cloud accounts, and search for backups before they announce themselves.

That change matters to a small business. Restoring files may get operations moving again, but it does not answer whether customer data was copied, whether an attacker still controls an account, or whether the company has a reporting obligation.

The first warning may not look like ransomware

Watch for logins from unfamiliar places, security tools being disabled, new administrator accounts, unexpected remote-access software, or a sudden wave of password resets. An employee may also report that a vendor invoice or bank instruction looks slightly different. Those clues deserve investigation before files begin changing.

What reduces the damage

• Use multifactor authentication, especially for email, remote access, and administrators.
• Keep operating systems, browsers, firewalls, and common business applications patched.
• Limit administrator rights instead of using an admin account for ordinary work.
• Maintain backups that everyday users and compromised accounts cannot erase.
• Test restores. A successful backup notification is not proof that recovery will work.
• Document who makes the decisions when systems, money, or sensitive data are at risk.

If you suspect an incident

Do not start deleting evidence or reconnecting machines at random. Disconnect affected devices from the network when practical, preserve suspicious messages and timestamps, and contact the people responsible for IT, insurance, legal guidance, and financial accounts. If money was transferred, call the financial institution immediately.

Whether a ransom should ever be paid is not a decision an IT provider should make alone. It can involve law enforcement, insurance coverage, sanctions rules, legal obligations, and the uncertain promise of a criminal. The better plan is to reduce the chance that the business reaches that decision with no alternatives.

Preparation does not need to be dramatic

Start with accounts, updates, backups, and a one-page response list. Those ordinary controls are not exciting, but they give a small business far more leverage than another shelf full of security products nobody manages.