Ransomware is one of the most feared words in cyber security. It is malicious software that locks you out of your own files and demands payment to hand them back — and for a small business, that can mean a closed shop, lost orders and days of disruption. In this guide I explain what ransomware is, how it gets in, what to do in the first hour, and how to protect your business.

I write this from experience. As IT & Digital Operations Manager at TechLand Bangladesh, I look after the systems and networks a business depends on every day. I also run my own e-commerce store, Synex Technologies, so I know the pressure of being responsible for everything — including security.

What Is Ransomware?

Ransomware is malware that encrypts the files on a computer or network — documents, photos, databases and customer records — then demands a ransom, usually in cryptocurrency, for the key. Until then, the files are unreadable.

A harsher type, double-extortion ransomware, also copies your data first and threatens to publish it online unless you pay — so the damage continues even after a restore.

Ransomware is not a random accident. It is a deliberate business model: criminals target small businesses because smaller teams often have fewer defences and less time to keep everything patched and backed up.

How Does Ransomware Usually Get In?

Ransomware rarely breaks through a firewall on its own. Usually, somebody lets it in without realising it — and each common entry point has a simple defence.

Phishing Emails

The most common route is a phishing email: a message that looks like an invoice, a delivery notice or a request from a manager, but carries a malicious attachment or a link to a fake login page. One click, and the infection begins. For background, see my guide to what malware is and how to remove it from a computer.

Weak or Reused Passwords

Many small businesses still use simple passwords, or the same password across several systems. Attackers try lists of common and leaked passwords against remote access and email accounts, then move quietly around the network before encrypting. Multi-factor authentication — a second check such as a code on your phone — makes this far harder.

Unpatched Software

Updates often fix security holes criminals actively exploit, so a computer running an old operating system or unpatched software is an open door. The same applies to your website: the website security basics every small business should know apply here too, because an unpatched website can become the way in.

Unsafe Downloads and Removable Media

Pirated software, free tools from untrusted sites and USB drives borrowed from outside the office can all carry ransomware. The fix is a simple rule: only install software from official sources, and never plug in a USB drive you do not trust.

What to Do in the First Hour If Ransomware Strikes

If you suspect an infection, the first hour matters. A calm, quick response limits the damage.

• Disconnect the affected device from the network immediately. Unplug the network cable or switch off Wi-Fi, so it cannot spread.
• Do not switch the device off and on again. Leave it as it is and photograph the ransom message for anyone who investigates later.
• Tell your IT support straight away. Call your IT provider now, not tomorrow — the sooner a professional looks at it, the better.
• Do not delete files or run random "cleaner" tools. Deleting files can destroy evidence and make recovery harder.
• Warn the rest of the team. Tell everyone not to open attachments or click links, and to report anything unusual.
• Check your backups — but carefully. Confirm a recent clean backup exists, and do not connect the backup drive to an infected machine.

Why Paying the Ransom Is a Bad Idea

When your files are locked and your business is stopped, paying can feel like the fastest way out. But there is no guarantee: some victims pay and receive nothing, while others get a decryption tool that only partly works. Paying also marks you as a business that pays, and the money funds further crime. In some places it can even have legal consequences, so get professional advice before considering it.

The only reliable way out is a clean, tested backup and a recovery plan — far cheaper than any ransom.

A Practical Prevention Checklist for Small Businesses

Prevention does not need an enterprise budget. Most defences against ransomware are basic, inexpensive habits done consistently.

• Back up regularly — and test the restore. Keep a copy of your important data separate from your main network — an external drive, or a reputable cloud backup service. A backup you have never tested is only a hope, not a plan.
• Keep everything updated. Turn on automatic updates for your operating system, browsers and apps, and patch your website and store software promptly.
• Use strong, unique passwords and multi-factor authentication. A password manager makes this practical. Switch on multi-factor authentication for email, banking, cloud services and remote access.
• Train your staff. Short, regular reminders about phishing work better than one long session nobody remembers. Make it safe for staff to report anything suspicious.
• Limit access to what people need. Give each person only the access their job needs, and remove accounts promptly when someone leaves.
• Plan for the worst. Write down, even on one page, who to call, what to disconnect and where the backups are.

Frequently Asked Questions

Can ransomware infect a phone or a Mac?

Yes, although Windows computers are the most common target. The same defences — updates, careful downloading and backups — apply on every device.

Will antivirus software stop ransomware completely?

Good security software blocks a great deal of it, but no single tool guarantees protection. It must be combined with training, updates and backups.

How do I know if a backup is safe to restore from?

A backup made before the infection is usually safe, if it was stored separately from the infected network. A drive connected during the attack may be encrypted too — which is why an offline copy matters.

Is a small business really a target, or only large companies?

Very much so. Attackers know smaller teams often have fewer defences and less time for security, and even a modest ransom is profitable at scale. Being small does not make you invisible.

Conclusion

Ransomware is a serious threat, but not an unstoppable one. It gets in through familiar doors — a phishing email, a weak password, an unpatched system — and most can be closed with straightforward habits: tested backups, timely updates, strong passwords, multi-factor authentication and staff awareness.

Start with one step this week: check your backups can be restored, switch on multi-factor authentication for your email, or run the pending updates on every device. Small, consistent actions keep a small business standing.