Ransomware: what it is and how to protect your business

Ransomware attacks are rarer than phishing, but far more damaging. The good news is that the best protection is simple and cheap.

What ransomware is

Ransomware is malicious software that locks up your files and systems, then demands payment to unlock them. Many gangs also steal your data first and threaten to publish it. That means good backups alone don't remove all the risk.

How attacks usually start

• A phishing email that steals a password or installs malware.
• Software or devices that haven't been updated. See our guide to zero-day vulnerabilities.
• Remote access, such as a remote desktop or VPN, protected only by a password.
• A supplier or IT provider being hacked first.

Only 1% of UK businesses reported a ransomware attack in the 2025/26 Cyber Security Breaches Survey, down from 3% the year before. But when it happens, a small business can be out of action for days or weeks.

The most important protection: offline backups

The NCSC's advice is clear. Keep backups that are separate from your network, either offline, offsite, or in a cloud service designed for it, because ransomware actively looks for connected backups to encrypt. Back up regularly, and test that you can actually restore.

Other basics that make a big difference

• Install updates quickly, especially security updates for devices that face the internet.
• Turn on multi-factor login, especially for email, cloud services and remote access.
• Use separate admin accounts, and only for admin tasks.
• Keep malware protection switched on on every device.
• Ask your IT provider how they protect the tools they use to manage your systems.

If you're hit

1. Disconnect affected devices from the network and the internet. Don't switch them off without expert advice, because that can destroy evidence.
2. Get expert help. If you have cyber insurance, call their incident line first, because most policies include incident response.
3. Report it to the NCSC at report.ncsc.gov.uk and to the police at reportfraud.police.uk. If personal data may have been affected, you may also need to tell the ICO.
4. Think carefully before paying. UK law enforcement does not encourage, endorse or condone paying ransoms. Paying doesn't guarantee you'll get your data back or that it won't be leaked.
5. Restore from clean backups. The attackers may have been inside before they struck, so make sure the backups are checked before you restore.

How this connects to Cyber Essentials

Cyber Essentials covers most of the ways ransomware gets in: updates within 14 days, multi-factor login on cloud services, malware protection, controlled admin accounts and secure settings. Add tested offline backups and you've covered the basics that stop most attacks.