What Ransomware Actually Is, and What It Does to a Small Office

Most people picture ransomware as a virus that scrambles your files and puts a note on the screen asking for money. That was accurate around 2015. It is now the least dangerous part of what happens, and the gap between that picture and the current reality is exactly where small offices get hurt.

Here is the version worth carrying around.

What it actually is

Ransomware is not really a piece of software. It is a business model, and the encryption is only the last step in it.

A modern incident runs roughly like this. Somebody gets access to your network — usually through a password, not through anything clever. They spend days, sometimes weeks, quietly looking around. They find where the files are, who the administrators are, and where the backups live. They copy out anything that looks valuable. Then, on a Friday evening or the night before a holiday, they encrypt everything at once and delete the backups they found.

The note that appears in the morning is the first thing you see and the last thing that happened.

This matters because it changes what you are defending against. If the threat is a file-scrambler, antivirus is a reasonable answer. If the threat is a person with your administrator password who has been reading your file server for a fortnight, antivirus was never going to be the thing that saved you.

The second demand nobody expects

Because the files were copied before they were encrypted, restoring from backup solves half the problem. The other half is that someone else now has your client list, your payroll, your contracts and whatever was in the shared drive nobody has audited since 2019.

This is usually called double extortion: pay to decrypt, and pay again so the copy is not published. It is now the norm rather than the exception, and it is the reason “we restored from backup, so we are fine” is an incomplete sentence.

It also converts a technical incident into a legal one. In Massachusetts, unauthorised acquisition of personal information about a resident triggers obligations under the state breach notification law regardless of whether you paid, restored, or noticed quickly. That is covered below.

How it gets in

Three routes account for most small business incidents, and none of them are exotic.

Stolen or reused credentials. Someone’s Microsoft 365 password appears in a breach of an unrelated service, and the same password works on your email. This is the most common route and the cheapest to close.

An exposed service left open. Remote desktop published to the internet so someone could work from home in 2020, still open in 2026. Scanners find these continuously and automatically.

An unpatched device. Not necessarily a computer — a firewall, a NAS, a VPN appliance. These sit in cupboards, run firmware nobody updates, and face the internet by design.

Notice that none of these three is “someone opened a bad attachment.” Attachments still matter, but they are no longer where the volume is.

The part that catches small offices out

The backup exists. It runs nightly. Nobody has ever restored from it.

This is the single most common failure we see, and it is not negligence — it is that restoring is tedious and nothing is visibly wrong, so it never reaches the top of anyone’s list. Then the day arrives when it matters, and the office discovers one of the usual problems: the backup covered the server but not the laptops where half the working files actually live; or it covered the files but not the line-of-business application’s database; or it ran successfully every night for eight months onto a drive that filled up in month two.

A backup you have not restored from is a belief, not a control.

What actually stops it

In order of how much protection each one buys, relative to what it costs you.

1. Multi-factor authentication on email and remote access. This is the highest-value control that exists for a small office, and for most it is included in what you already pay Microsoft. It converts the most common entry route from an open door into a dead end. If you do one thing from this page, do this one.

2. A backup the attacker cannot reach. Offline, or in a service with its own separate credentials and versioning, so that compromising your network does not compromise your recovery. Then restore something from it this quarter, and write down how long it took.

3. Remove local administrator rights from daily accounts. Free, and it stops a large share of what happens after the first click. Disruptive for about two weeks, then invisible.

4. Patch the things that face the internet, on a schedule you can name. Firewall, VPN, remote access, NAS. These are the devices nobody owns and everybody assumes are fine.

5. Endpoint protection that reports somewhere central. Having antivirus installed on each machine is not the same as anyone finding out when it fires. The second part is the one that matters.

None of this is a product you buy. It is four or five decisions and someone whose job it is to keep them true.

Where Massachusetts adds an obligation

If you hold personal information about a Massachusetts resident — and if you have employees or clients here, you do — you are inside 201 CMR 17.00. There is no headcount threshold and no revenue floor.

That regulation already requires a written information security program, and several of the controls above are named in it directly. So a ransomware incident does not only cost you the downtime and the data. It also surfaces, in front of a regulator and possibly a plaintiff, whether the program you were required to have actually existed.

Separately, Massachusetts breach notification law obliges you to notify affected residents and the Commonwealth when personal information is acquired without authorisation. Because modern ransomware copies data out before encrypting it, “we restored everything” does not remove that obligation. Our post on what 201 CMR 17.00 actually requires covers the program side in detail.

What we would do first

If you called us on a normal Tuesday and asked where to start, we would not begin with ransomware. We would begin with two questions that take an afternoon to answer:

Is multi-factor authentication on for every account that can read email? Not most. Every. The one account without it is the one that gets used.

When did someone last restore a file from your backup, and how long did it take? If the answer is “never” or “I’d have to check”, that is the whole project.

Everything else on this page is worth doing, and none of it matters as much as those two.

If you would rather have someone else establish those answers, you can text or email us without sitting through a pitch first.

Sources

• Cybersecurity and Infrastructure Security Agency — #StopRansomware
• CISA, FBI, NSA and MS-ISAC — #StopRansomware Guide
• FBI Internet Crime Complaint Center — Annual Reports
• Commonwealth of Massachusetts — 201 CMR 17.00 compliance checklist