Ransomware: What It Is and How to Protect Your Business

Ransomware is malicious software that encrypts your company’s files and demands payment for the decryption key - increasingly also threatening to publish stolen data. It gets in through phishing, exposed internet services, and leaked passwords. Three defenses matter: closing unneeded services, MFA, and a 3-2-1 backup the attack can’t encrypt. Start by checking what your business exposes to the internet.

This guide is written for the owner of a small practice - dental office, CPA firm, med spa - not for an IT department. It shows what a ransomware attack on a small business actually looks like, how it gets in, what the numbers say, and how to build a backup the attack can’t destroy. Ransomware is one of the threats mapped in our guide to cyber threats for business - here we take it apart.

A reconstruction of a typical ransom-note screen (layout modeled on WannaCry, 2017). Details vary between groups, but the pattern repeats: a countdown, a wallet address, and a price-doubling threat - all designed to force decisions under pressure.

1. What ransomware is and what an attack looks like

Ransomware is a program that, once running inside a business network, encrypts files: documents, databases, photos, and every backup it can reach. Encrypted files cannot be opened without a key, and only the attacker has it. A note appears on the screen or in the folders demanding payment - usually in cryptocurrency - with a deadline after which the price goes up or the data is supposedly gone for good.

Modern attacks rarely stop at encryption. Double extortion has become the standard: before triggering the encryption, the attacker steals a copy of the data and threatens to publish or sell it. That changes the math. Even a business with a solid backup, able to restore its files without paying, still faces the question of what happens to its patient or client data - and no payment un-steals stolen data.

The pressure itself is engineered. Ransomware groups run “victim support” portals on the Tor network with live chat and a countdown to the next price increase - and public leak sites where they post the data of companies that refuse to pay. The victim is meant to feel they are dealing with a functioning institution, not a criminal. It is theater, but effective theater - which is why decisions after an attack should follow the procedure in section 6, not the timer.

For a dental office, a CPA firm, or a med spa, an attack means the day the patient records, the appointment calendar, and the books simply don’t open - while the phone keeps ringing. The real cost is rarely the ransom itself: it is downtime measured in days, data recovery, client communication, and the legal duties that follow a breach.

2. How ransomware gets into a business: three doors

An attack almost never starts with a movie-style break-in. Ransomware enters through three doors - and all three can be checked ahead of time.

The first door is phishing: an infected attachment, a link to a fake login page, or a stolen password. It is the most common first step because it costs the attacker the least. How it works and how to defend against it is covered in our separate guide to phishing - for ransomware purposes, remember that one click on an attachment can start the whole sequence.

The second door is a service exposed directly to the internet: RDP remote desktop (working “remotely” on an office computer), an admin panel, or an open database. Device search engines like Shodan index them automatically, so the attacker doesn’t have to hunt - they get a list. Then they guess, crack, or buy a password and log in like an employee. Sometimes no password is needed at all: a known, unpatched vulnerability in the service or an edge device - a router, a VPN appliance, a firewall - is enough. Sophos’ State of Ransomware names exploited vulnerabilities as the most common root cause of attacks, which makes updates door-closing, not cosmetics. We walk through the single-open-port scenario in one open port: how ransomware reaches a business.

The third door is leaked credentials. Email addresses and passwords from breaches of other services circulate for years; there are even specialized brokers (initial access brokers) who buy and resell ready-made access to companies. If the same password works for email and for remote access, the attacker doesn’t crack anything - they log in with the first working password on the list. That is why MFA (multi-factor authentication) closes this door more reliably than any training.

Door	What it looks like in practice	First defense
Phishing and attachments	An “invoice” in email, a fake login link	The habit of verifying outside the message; MFA on email
Exposed internet service	RDP, an admin panel, an open database	Close the service or put it behind a VPN
Leaked credentials	Logging in with a password from another breach	Unique passwords from a manager + MFA; leak monitoring

3. Ransomware by the numbers: 2025-2026

The FBI’s Internet Crime Complaint Center logged more than 3,600 ransomware complaints in 2025, with reported losses above $32 million, according to the IC3 2025 Annual Report. The IC3 itself notes that this loss figure excludes downtime, equipment, and remediation - exactly the costs that hurt a small practice most. And of all critical infrastructure sectors, healthcare and public health was hit hardest, with 460 reported ransomware attacks - the sector where dental practices and med spas live.

The pattern repeats in breach data. The Verizon Data Breach Investigations Report 2026 found ransomware present in 48% of confirmed data breaches - and where the victim’s size was known, 96% were small and medium businesses. This is not a weapon aimed at corporations: the campaigns are automated and land wherever a door is open and recovery is weakest.

The costs split differently than intuition suggests. Sophos’ research shows recovery costs regularly exceeding the ransom itself several times over - the expensive part is downtime, specialist work, and lost business. At the same time, victims pay less and less often: per DBIR 2026, the median payment fell below $140,000 and only about a third of victims paid at all. A good backup turns a negotiation with an extortionist into file cleanup.

4. What we see in our scans of small practices

Before an attacker picks a target, they check the business from the outside - with an automated scanner, in minutes, without touching anything inside. In our scans we do exactly the same thing, so the owner sees the result first. The picture from small dental, accounting, and aesthetic practices is unambiguous.

Of the practices we covered with a deep service scan, 60% had a publicly reachable MySQL database (port 3306), and 40% had an FTP server transmitting data unencrypted. Each such service is a ready-made second door from the table above: walking through it requires no phishing and no sophisticated tooling. Our scan base is small European practices, but the misconfigurations are identical on US domains - open ports don’t care about geography, and neither do the attackers’ scanners.

The second pattern is passwords. At 22% of the practices we scanned, a staff email address appeared in a publicly known data breach, and at 17% it came with a plaintext password. That is the third door in its purest form: the attacker breaks nothing, they just log in. On top of that, 72% of the domains could be spoofed through email configuration gaps (SPF, DKIM, DMARC) - and phishing, as the table reminds you, is door number one; our guide to phishing covers that thread.

Checking these three areas - exposed services, leaked credentials, and domain configuration - is a standard part of our external vulnerability assessment.

5. A backup that survives the attack

From entry to encryption usually takes anywhere from a few hours to a few days. In that window the attacker moves around the network, steals data, and hunts for backups - the ones they find get deleted or encrypted first. A permanently connected USB drive and a mapped network share are therefore not backups: from the ransomware’s point of view, they are just more folders to encrypt.

The model that survives an attack is called 3-2-1: three copies of your data, on two different media, one of them off-site. For a dental office that can mean: the data in the practice system, a copy on a local server, and a copy in the cloud with a backup provider. The third one is the key - separated from the office network firmly enough that an infected computer’s account has no write access to it.

Separation takes two practical forms. An offline copy is physically disconnected after each run - a drive that goes into a drawer, or better, off the premises, is out of the attack’s reach. An immutable copy is a feature of modern backup services: for a set period it cannot be overwritten or deleted, even from an administrator account, even when the attacker has every password.

Set the backup frequency by answering one question: how many days of work can the business lose for good? If the answer is “one at most,” the backup has to run daily. Cover what cannot be rebuilt by hand: the practice-management database, documents, email, and configuration - not just a documents folder. If your practice software runs in a vendor’s cloud, ask the vendor directly what their backups cover and how fast they can hand your data back after an incident; “we have backups” on their side does not replace having your own copy.

An untested backup is an assumption, not a safeguard. Once a quarter, restore one file and one database from the copy - that verifies the backup works at all. Once a year, measure how long restoring the whole environment would take: hours or days? That number tells you how long the business would stand still after an attack - and whether it can afford it.

The three stages of an attack map to a simple defense plan:

Attack stage	What the attacker does	What protects your business
Entry	Phishing, logging into an exposed service, a leaked password	Closing unneeded services, MFA, updates
Reconnaissance	Moves through the network, steals data, hunts for backups	Accounts without admin rights, EDR (endpoint detection and response), acting on alerts
Encryption and extortion	Encrypts files, demands payment, threatens publication	A 3-2-1 backup, offline or immutable, with tested restores

6. Attack in progress: what to do hour by hour

Hour zero usually looks like this: the system won’t open in the morning, and a ransom note sits on the desktop. The order of actions matters - and nothing costs the business more than panic.

Disconnect infected computers from the network - unplug the cable, turn off Wi-Fi. Don’t power them off: the memory of a running machine can hold traces that help specialists analyze the attack and recover data.
Don’t delete or reinstall anything. Photograph the ransom note and preserve the logs - you will need them for analysis, for reports, and for your cyber-insurance carrier.
Report the attack to the FBI at ic3.gov and use the resources at CISA’s StopRansomware. Reporting doesn’t trigger an inspection - it triggers help.
Check nomoreransom.org - a joint project of Europol and security companies. Free decryptors exist for some ransomware families - check before anyone starts a conversation about paying.
Assess your breach-notification duties. Encrypted patient or client data is a loss of availability, stolen data a loss of confidentiality - both count. For health data, HIPAA gives you up to 60 days to notify affected individuals and HHS; for client financial data at a CPA firm, the FTC Safeguards Rule requires notifying the FTC within 30 days for incidents affecting 500 or more consumers; state breach laws add their own clocks. We map these duties in the guide to data security compliance.
Leave the ransom decision for last. Payment guarantees neither a working key nor that stolen data stays off the internet - and it funds the next campaigns. Per DBIR 2026, most victims don’t pay. If you consider paying at all, do it with a lawyer and after contacting law enforcement: paying a group under US sanctions can itself create legal exposure, something the Treasury’s OFAC has explicitly warned about.

Time matters, blame doesn’t. An employee who immediately reports that something is wrong cuts the attack short by hours - in a business where reporting earns a reprimand, you learn about the attack from your clients. If you carry a cyber policy, call the insurer at the start, not the end: many policies require notice within a set window and provide their own incident-response specialists.

Communication is its own thread. Patients and clients forgive an incident faster than silence: prepare a short, factual note about what happened, what you are doing, and whose data is involved - before the phones start ringing. The same text will serve in conversations with vendors and partners whose files are waiting for your systems to come back.

7. Ransomware in a dental practice, a CPA firm, and a med spa

In a dental practice, ransomware stops the patient records, the appointment calendar, and the imaging system at once - patients keep arriving, and the documentation is gone. Health data makes the publication threat especially painful, and the IC3 data shows healthcare as the hardest-hit sector. The specifics are in our dental practice cybersecurity guide and on the dental practices service page.

In a CPA or accounting firm, the calendar is the sharpest edge: an attack at the peak of filing season means downtime exactly when clients are waiting on returns - and the encrypted files hold many businesses’ data at once. More in the accounting firm cybersecurity guide and on the accounting firms service page.

In a med spa, double extortion cuts deepest: stolen before-and-after photos are material whose publication destroys trust faster than any downtime. Details in the aesthetic medicine cybersecurity guide and on the aesthetic medicine service page.

Not sure which doors your business has open? Book a free PreScan - within 24 hours we’ll check from the outside, among other things, whether your business exposes services to the internet and whether staff email addresses are circulating in breaches together with passwords. No access and no installs required on your side.

FAQ

What is ransomware and how does it work?

Ransomware is malicious software that encrypts the files on a company’s computers and servers, then demands payment for the decryption key. Modern attacks add a second extortion: before encrypting, the attacker steals a copy of the data and threatens to publish it. The business loses access to records, scheduling, and bookkeeping - work stops, and the pressure grows by the hour.

How does ransomware get into a business?

Through three doors: phishing (an infected attachment or a stolen password), a service exposed to the internet (RDP remote desktop, an open database, a login panel), and leaked credentials the attacker simply logs in with. All three can be checked and closed before anyone uses them - that is the cheapest moment to defend.

What should I do in the first hour of a ransomware attack?

Disconnect infected computers from the network - unplug the cable, turn off Wi-Fi - but don’t power them off and don’t delete anything. Photograph the ransom note. Report the incident to the FBI at ic3.gov and check nomoreransom.org for free decryptors. If patient or client data was in the encrypted systems, breach-notification clocks start running.

Should I pay the ransom?

Don’t make that decision first. Payment guarantees neither a working decryption key nor that stolen data stays private, and it funds the next attacks - according to Verizon DBIR 2026, most victims don’t pay. First check the free decryptors at nomoreransom.org and whether your backup can restore the data; involve a lawyer and law enforcement before any payment.

Does a ransomware attack have to be reported?

Assess it like any data breach. For health data, HIPAA requires notifying affected individuals and HHS within 60 days; for client financial data at a CPA firm, the FTC Safeguards Rule sets a 30-day clock for incidents affecting 500 or more consumers, and state breach laws add their own. Document the incident and your assessment either way.

One open port: how ransomware reaches a business
External vulnerability assessment - checks, among other things, what your business exposes to the internet

Neighboring pillars:

Informational material, not legal advice. Facts as of July 12, 2026. Consult a lawyer on notification duties and any ransom decision in a specific incident. Figures from annual reports (FBI IC3, Verizon DBIR, Sophos) are updated as new editions are released.