What Is Ransomware and How a Business Avoids Paying the Ransom

Ransomware is malware that encrypts files on a business's computers and servers, after which the attacker demands a ransom for the key to unlock them. A business with a working backup out of the attacker's reach does not have to pay: it cleans the systems and restores the data from the backup.

An attack does not look dramatic. One morning files have strange extensions, a program cannot open its database and a note on the screen explains how to pay.

More and more often attackers steal data before encrypting it and threaten to publish it if the business does not pay. The US agency CISA calls this double extortion. A backup then restores operations, but it does not undo the leak.

ENISA, the EU cybersecurity agency, names ransomware the most impactful threat in the EU in its Threat Landscape 2025 report. Attackers do not care about company size: an unpatched computer or a stolen password is enough.

ServiceIT support for businesses

How Ransomware Gets into a Business

01Email with an attachment or link

A fake invoice, a courier notice or a message that looks like it is from the bank. CISA lists phishing among the common ways in.

02Stolen password

An account without two-step login, especially for email, VPN or remote access.

03Unpatched system

A computer, server or router with a known flaw, reachable from the internet, such as an open remote desktop (RDP).

04Through a supplier

A technician or program with access to your network. CISA recommends assessing the risk from outside firms that manage your systems.

Why You Should Not Pay the Ransom

Paying does not guarantee you get your data back. The No More Ransom project, run by Europol and the Dutch police with partners, advises never to pay: payment proves to criminals that the scheme works, and a working key is not guaranteed.

If data was also stolen, paying does not guarantee the attacker will not publish or sell it either. You would be paying someone who has already broken every rule once.

Before any decision, check the No More Ransom website. Free decryption tools exist there for some ransomware families, and the Crypto Sheriff tool helps identify which one hit you.

The real answer to "should we pay" is given months earlier: a backup the attacker cannot reach and a plan for the first hour. A business that has both can say no.

GuideData backup and the 3-2-1 rule

GuideIT support for businesses

The First Hour After an Attack: What to Do

When you see a ransom note, the goal is to stop the spread and preserve evidence. This is the order from the CISA guide, adapted for a small business:

Disconnect affected computers from the network right away: unplug the network cable and turn off Wi-Fi.
Do not shut a computer down if you can isolate it another way, because shutting down erases evidence in memory that helps the investigation.
Disconnect any backups that are still attached so they are not next.
Call your IT support by phone, not by email from an account that may be compromised.
Photograph the ransom note and write down when you noticed it.
Report the incident to the National CERT and the police, and to the Commissioner if personal data is affected.

How a Business Avoids Having to Choose

Prevention is boring, and that is why it works. Three things close many of the routes ransomware uses: two-step login on email and remote access, patches installed as soon as they are released and an offline backup.

CISA recommends offline, encrypted backups with regularly tested restores, phishing-resistant multifactor authentication for all services, especially email and VPN, and never exposing remote desktop to the internet.

Teach staff to recognize a suspicious email and to report it without fear. An employee who says straight away that they clicked a link helps the business, while one who hides it out of fear gives the attacker time.

Give every account only the rights it needs. If an employee has no admin rights on their computer, ransomware launched from their account has a harder time reaching the rest of the network.

A Ransomware Protection Checklist

Go through this list with whoever maintains your computers. Every item where the answer is "I don't know" is a place to start.

All computers and servers get patches as soon as they are released, and someone checks this daily.
Email, VPN and admin accounts have two-step login.
Remote desktop is not exposed to the internet.
There is a backup that office computers cannot change or delete.
A restore from backup has been tested in the last three months.
Staff work without admin rights.
Everyone knows who to call first, and on which number, if a ransom note appears.
The inventory of equipment and accounts is up to date.

GuideBusiness computer maintenance

PlansIT support plans

Recovery: Restoring Data from Backup

Once computers are cut off from the network, do not restore data straight away. First find out how the attacker got in and remove them, or the restored files will be encrypted again.

Affected computers are normally reinstalled from scratch, all passwords are changed, especially admin and email ones, and only then is data restored from a backup made before the attack.

How long recovery takes depends on how fresh the backup is and how fast it restores. That is why restores are tested in advance, while nothing is urgent, not for the first time after an attack.

ContactAsk us about protection

Frequently Asked Questions About Ransomware

What is ransomware?

Malware that encrypts files on a device so they become unusable, while the attacker demands a ransom for the key. Attackers often steal the data first and threaten to publish it.

Should we pay the ransom?

It is not recommended. No More Ransom, a Europol and Dutch police project, advises never to pay, because a key is not guaranteed and paying funds new attacks. Check there whether a free tool exists for your ransomware family.

Does antivirus protect against ransomware?

It helps, but it is not enough on its own. Most of the protection comes from timely patches, two-step login, staff without admin rights and a backup the attacker cannot reach.

Do we have to report the attack in Serbia?

Operators of ICT systems of special importance must report within 24 hours (Law on Information Security, Article 13). If personal data is affected, the Commissioner must be notified without undue delay, where feasible within 72 hours (Law on Personal Data Protection, Article 52).

Can a small business be a target?

Yes. Many attacks do not pick businesses by size but look for any unprotected way in: an open remote desktop, an unpatched system or a stolen password. A small business often has nobody watching those entry points.

What Is Ransomware and How to Avoid Paying