Ransomware rarely begins with a dramatic warning. It may start with a stolen password, a convincing phishing message, an unpatched remote-access tool or a vendor account that quietly gives criminals a foothold. Attackers can spend days or weeks exploring a network, stealing data and weakening backups before they encrypt files.
Preparation changes the outcome. The FBI received 3,611 ransomware reports in 2025, according to its latest annual reporting. A written plan, tested backups and rehearsed decisions can keep a disruptive incident from becoming an existential crisis.
What does a modern ransomware attack look like?
Ransomware is no longer only file encryption. Criminals may steal sensitive information first, then threaten to publish it unless the victim pays. CISA describes this combination as double extortion. Some groups skip encryption and rely entirely on stolen-data threats.
Common entry points include phishing, reused passwords, exposed remote services, unpatched software and compromised vendors. Warning signs can appear before the ransom note:
- Unusual logins, especially from unfamiliar locations or at odd hours
- New administrator accounts or unexpected privilege changes
- Security tools, backups or logging services being disabled
- Large outbound data transfers or unexplained network slowdowns
- Repeated file-access failures, renamed files or mass file changes
- Unexpected use of remote-management or command-line tools
One symptom does not prove an attack, but a cluster of anomalies deserves immediate investigation. Do not wait for encryption to confirm the threat.
How can a business prepare for ransomware?
- Identify critical operations. List the systems, accounts, vendors and data your business needs to deliver essential services. Set a recovery order before pressure distorts decisions.
- Maintain protected backups. Keep offline or otherwise isolated, encrypted copies that ransomware cannot reach through normal administrator credentials. CISA recommends maintaining offline, encrypted backups and testing them regularly.
- Strengthen access. Require phishing-resistant multifactor authentication for email, remote access, cloud services and administrator accounts. Remove dormant accounts and limit privileges.
- Patch exposed systems quickly. Prioritize internet-facing devices, remote-access products and known exploited vulnerabilities. Replace unsupported hardware and software.
- Prepare an incident-response plan. Assign decision-makers, technical leads, legal counsel, cyber-insurance contacts, communications owners and law-enforcement contacts. Store a printed or offline copy.
- Practice the plan. Run a tabletop exercise that begins with strange network behavior and escalates to unavailable systems and a data-leak threat.
How should you test ransomware backups?
A backup is only useful if your team can restore it. At least quarterly, select representative systems and files, restore them into a clean environment and confirm that the data opens. Measure recovery time, document missing dependencies and verify that attackers cannot delete backup copies with ordinary production credentials.
Include cloud services in the exercise. Version history and synchronization are helpful, but they are not automatically independent backups. Confirm retention periods, deletion protections and recovery procedures with each provider.
What should you do when ransomware is suspected?
Move quickly, but do not improvise. Use the response plan and a trusted communication channel that attackers are unlikely to monitor.
- Isolate affected systems. Disconnect them from networks and shared storage without deleting evidence. CISA advises immediately isolating impacted systems and prioritizing critical systems when broad disconnection is necessary.
- Activate the incident team. Notify leadership, IT or security, legal counsel and the cyber-insurance carrier through approved channels.
- Preserve evidence. Save logs, alerts, ransom notes and relevant timestamps. Avoid wiping or rebuilding systems until responders approve.
- Determine the scope. Identify affected accounts, systems, backups and data. Assume stolen credentials may remain dangerous.
- Report the incident. Contact the FBI through IC3 and request assistance from CISA when appropriate. Early reporting may connect your case to known infrastructure or decryption resources.
- Recover cleanly. Remove persistence, reset exposed credentials and restore prioritized systems from verified backups on a clean network.
Should your business pay a ransomware demand?
Do not make that decision alone or under an attacker’s deadline. Payment does not guarantee working decryption, deletion of stolen data or freedom from another demand. Involve law enforcement, legal counsel, insurers and experienced incident responders. Also check whether sanctions or other legal restrictions apply.
Why ransomware readiness makes your business safer
Preparation reduces both the likelihood and impact of an attack. Strong access controls and patching close common entry points. Monitoring can expose criminals before deployment. Isolated backups give the business a recovery path that does not depend on an attacker’s promise. A rehearsed plan also replaces panic with clear authority, faster containment and more reliable communication.
NIST’s 2026 ransomware profile organizes readiness around governing, identifying, protecting, detecting, responding and recovering. Use that framework to turn today’s checklist into an ongoing program rather than a one-time project.
Start this week: choose an incident owner, test one critical restore and schedule a 60-minute tabletop exercise. The best time to discover a broken backup or an unclear decision path is before an attacker does.
