Ransomware Is on the Rise: It’s Never Been More Important to Back Up Your Data
  • 29
    Jan

Ransomware Is on the Rise: It’s Never Been More Important to Back Up Your Data

Ransomware is malware that encrypts your files and demands payment for the key to unlock them. We have been called out to businesses hit by it, and the story is always the same: the attack takes minutes, and what decides whether it is a bad afternoon or a business-threatening disaster is the state of the backups before it happened.

How ransomware gets in

  • Phishing emails with malicious attachments or links, still the most common route.
  • Exposed remote access, such as remote desktop or a VPN that is internet-facing, unpatched or protected by a password alone.
  • Unpatched software on PCs, servers and firewalls.
  • Malicious downloads, such as cracked software, fake updates and “free” utilities.

What happens next

Modern ransomware usually goes hunting for your backups first: it deletes Windows restore points and tries to switch off security software. It then encrypts files on the PC and on every network share and attached drive it can reach, and drops a ransom note in the folders it has locked. Many attackers also copy your data before encrypting it and threaten to publish it. That makes it a data breach as well as an outage.

One client we attended was hit by CryptoLocker, an early member of this family. Their backup drive was plugged into the PC at the time, so it was encrypted too, leaving no copy to restore from. That is the single most common way we see a recoverable incident turn into a permanent loss.

Can you get your files back?

Removing the malware itself is usually the easy part. Getting the encrypted files back without the key is, in most cases, impossible: the encryption is the same kind that protects online banking. Free decryption tools exist for some older ransomware families (see No More Ransom), but you cannot count on one existing for the strain that hits you.

Paying is not a safe answer either. You are dealing with criminals, there is no guarantee you will receive a working key, and paying marks you out as a business that pays. The NCSC and law enforcement advise against paying. The reliable way back is a clean backup.

How to protect your business

  1. Have proper, tested backups. Back up every PC and server, follow the 3-2-1 rule (three copies, two types of storage, one off-site), and keep at least one copy offline or immutable so ransomware cannot reach it. Backups you have never restored are not proven. Our IT disaster recovery plan guide covers how to plan for this.
  2. Don’t leave backup drives permanently connected. If you use USB drives, rotate at least two and disconnect them after each backup, as in the story above. A connected drive is as exposed as the PC it is attached to.
  3. Turn on multi-factor authentication (MFA) for email, remote access, VPNs and admin accounts. Stolen passwords are a leading way in.
  4. Keep everything patched: Windows and Office updates, plus firewalls, routers, VPNs and server software. Don’t expose remote desktop directly to the internet.
  5. Use modern endpoint protection on every PC and server, and filter email for malicious attachments and links.
  6. Train your staff. Most attacks need someone to click. Teach people to be suspicious of unexpected attachments and urgent requests, and make it easy and blame-free to report something odd (see our guide to avoiding scams, spam and phishing).
  7. Limit what people can do. Use standard accounts for day-to-day work rather than admin accounts, and keep company data on a protected, backed-up file server or cloud storage, not on individual PCs.

If you think you have been hit

  1. Disconnect the affected PC from the network straight away (unplug the cable and turn off Wi-Fi) so it cannot spread.
  2. Don’t wipe or reinstall anything yet, and call your IT support provider.
  3. Check which systems and backups are affected before you restore anything, and restore only from backups you know are clean.
  4. If personal data may have been taken or lost, you may have to report it to the ICO within 72 hours, and you should report the incident to the police. The NCSC ransomware guidance is a good place to start.

If you want help with backups, security or an incident response plan, please contact us.

Need a hand? Lennox IT provides IT support for businesses in Derby, Nottingham and the East Midlands, and supports customers and sites across the UK. Get in touch or see our IT support plans.

Last reviewed: October 2026.

Leave a Reply