What Is Ransomware, and Would Your Business Actually Recover?
Ransomware is malicious software that encrypts your files and demands payment for the key. That definition is accurate and almost useless, because it describes the symptom rather than the event. What actually happens to a business is a chain that starts weeks earlier, and the outcome is decided long before anything is encrypted, by whether your backups were somewhere the attacker could reach.
How an attack actually unfolds
It rarely begins with encryption. It begins with access, usually through one of three routes: a password that was reused and appeared in a breach elsewhere, a remote access service exposed to the internet without multi-factor authentication, or an unpatched internet-facing system.
Once inside, the attacker looks around. They find out what you have, where your data is, which accounts have administrative rights, and crucially where your backups are. This phase often lasts days or weeks, and it is quiet because being noticed here ruins the payday.
Then they take a copy of your data, because stolen data is leverage independent of encryption. Only after that do they encrypt, usually out of hours, and usually starting with the backups. By the time you see a ransom note, the decision about whether you can recover has already been made.
This is why "we have backups" is not an answer to the question. The relevant question is whether your backups were reachable from a compromised administrator account, because if they were, they are encrypted too.
The stolen data changes the calculation
Double extortion is now standard: pay to decrypt, and pay again to stop publication. Restoring cleanly from backup solves the first problem entirely and the second not at all.
For a UK business this creates obligations independent of whether you recover. A ransomware incident involving personal data is very likely a reportable breach, with a 72-hour clock to the Information Commissioner. Customers and staff may need telling. Paying the ransom does not discharge any of that, and there is no guarantee the copy is deleted.
It also means the incident does not end when systems come back. The reputational and regulatory tail runs for months.
Why backups fail when it matters
The most common failure is reachability. A backup on a network share, a NAS in the same building, or a cloud account accessible with the same credentials as production is not protected from an attacker holding those credentials. Modern ransomware deletes backups first and does so competently.
The second most common failure is that nobody has ever restored. Backup software reports success on jobs that produce unusable output more often than people expect, and the discovery moment should not be during an incident. A restore that has never been tested is a hypothesis.
The third is time. Businesses that can restore often find it takes far longer than anyone assumed, because nobody measured it and nobody worked out which systems have to come back first or what depends on what. A week of downtime can be worse commercially than the ransom.
The fourth is coverage. Microsoft 365 is the usual gap. Retention policies are not backup, and a mailbox deleted or encrypted beyond the retention window is gone. Most small businesses assume Microsoft is backing up their data, and Microsoft protects the platform rather than your content.
What actually reduces the risk
Multi-factor authentication on everything reachable from the internet, especially email and remote access. This single control removes the most common entry route, and it is why the Cyber Essentials scheme made it mandatory.
Backups that are offline, immutable, or held in a separate account with separate credentials, tested by an actual restore at least annually with the time recorded.
Separating administrative accounts from day-to-day accounts, so that compromising someone reading email does not hand over the estate.
Patching internet-facing systems within a fortnight, and knowing what your internet-facing systems are, which is a surprisingly common gap.
None of this is exotic and none of it is expensive relative to an incident. It is the same list every time because the attacks are the same every time.
Two questions worth answering this week
If an attacker held domain administrator credentials right now, could they reach and delete every copy of your backups? If you cannot answer confidently, that is the finding.
When did you last restore something substantial from backup, and how long did it take? If the answer is that nobody has, you do not currently know whether you have backups. You have backup jobs, which is a different thing.