What ransomware actually does to your files

Ransomware is a type of harmful program that locks your files and asks for money to unlock them. It's one of the most common threats to small businesses, because small businesses often don't have a way to recover.

How it gets in

Usually through something ordinary: an email attachment, a link to a fake website, or a password that's been guessed or leaked. Sometimes it comes in through a computer that hasn't had its updates for a while.

What happens to your files

Once it's running, ransomware works through every file it can reach and scrambles it. Your documents, spreadsheets and photos are still there, with the same names, but they won't open. They've been turned into nonsense that only the attacker's key can turn back.

It doesn't stop at one computer. It looks for shared folders, other computers and connected drives, and scrambles those too. That includes the USB backup drive that's always plugged in.

Then a message appears, asking for payment, often in cryptocurrency, with a deadline. Some attackers also copy your files first and threaten to publish them.

Should you pay?

Paying is no guarantee. Some businesses pay and never get their files back, or get attacked again. It also funds the next attack. The National Cyber Security Centre advises against paying.

What actually protects you

• Backups ransomware can't reach. This is the big one. A backup that's always connected can be scrambled along with everything else. You want at least one copy that's kept separately and can't be changed or deleted, even by someone with your passwords.
• Testing your backups. A backup you've never restored from is a hope, not a plan.
• Keeping computers up to date, so known weak spots are closed.
• Two-step sign-in, so a stolen password isn't enough.
• Website and threat protection on your network to block many attacks before they arrive.
• Staff who know what to look out for.

If it happens

Disconnect affected computers from the network straight away. Don't wipe anything. Get help, and report it to Action Fraud (or Police Scotland on 101 if you're in Scotland).

How we can help

We set up backups for small businesses that are copied to secure cloud storage ransomware can't delete, and we check they're working. To talk about yours, email [email protected].