Monday Morning, 7:30 AM. Nothing Works.
Picture this: you arrive at the office, turn on your computer, and a message appears on screen. Not from a colleague, not from a customer. From someone informing you that all your company's data has been encrypted. €250,000 in Bitcoin, 72 hours. Otherwise, your customer data gets published.
It sounds like a bad movie. But it happens—every day, across all of Europe. 70% of all SMEs have been targeted by a ransomware attack in the last two years. Average downtime afterwards: three weeks. And 60% of severely affected companies go bankrupt within six months.
Ransomware Isn't What It Used to Be
In the old days, extortionists simply encrypted your data and waited for the ransom. Anyone with a good backup could sit back and relax. Those days are over.
Today, experts call it "Double Extortion"—attackers steal your data first, before encrypting it. Then they threaten not only to withhold the decryption key, but also to publish sensitive information. Customer contracts, employee data, trade secrets—everything ends up on so-called leak sites on the darknet.
Some groups go even further. With "Triple Extortion," they additionally launch DDoS attacks against your website and contact your customers directly. "Did you know that Company X can't protect your data? Here's the proof."
It's become an industry. Ransomware-as-a-Service, or RaaS: criminals develop the software and rent it to other criminals—complete with dashboard, customer support, and affiliate commissions. Yes, there are actually criminal help desks that explain to victims how to buy Bitcoin.
How Does Ransomware Get In?
In 65% of all cases, through email. An invoice from your accounting firm that looks genuine. A job application with a manipulated PDF. A message from "IT support" requesting a click. The emails today are so well-crafted that even experienced employees can't spot them.
In second place: insecure remote access. The pandemic's legacy. Many companies hastily set up VPN connections or opened RDP ports back then—and never closed them again. Without multi-factor authentication, these access points are like a window left open day and night.
Then there are the silent doors: outdated software. 60% of all successful attacks exploit vulnerabilities for which patches were already available. That means the fix already existed—it just wasn't installed. An unpatched Exchange server is like a sign at the entrance: "Please break in."
How to Prepare—Before It Happens
The Backup Question No One Asks
Every company has backups. Or thinks it does. The crucial question isn't "Do you have backups?" but "Can you restore your systems from backup within 24 hours?"
If you can't answer that with a clear yes, you have a problem. And if your backups sit in the same network as your production systems, you have an even bigger problem—because modern ransomware specifically searches for backup servers and encrypts those too.
The extended backup rule is called 3-2-1-1-0: three copies of your data, on two different media, one copy offsite, one copy offline or immutable (unchangeable), and zero errors in regular restore tests. Sounds involved? It is. But it's the difference between "we had three stressful days" and "we're closing up shop."
Your Network Isn't an Open-Plan Office
Most SME networks are flat. That means: if an attacker gains access to a single workstation, they can move freely through the entire network. From the reception desk to the accounting server, from there to the production system.
Network segmentation sounds like a big project but can start simply. At minimum, separate your production network from the office WiFi, completely isolate the guest WiFi, and put IoT devices like printers and cameras in their own segment. Most modern firewalls and switches can do this—it's mainly a matter of configuration, not hardware.
Patch, Patch, Patch
I know update notifications are annoying. But every critical vulnerability you don't close within 48 hours is an open invitation. Set up a fixed rhythm: critical updates immediately, regular updates every two weeks. And if you have legacy systems that can no longer be patched—isolate them as if they were radioactive.
What to Do When It Happens Anyway
The first 60 minutes determine everything. And that's precisely why you need a plan before the emergency strikes.
Step one: Isolate, don't shut down. Unplug network cables, turn off WiFi—but leave the computer running. The RAM contains forensic evidence that's lost if you pull the plug.
Step two: Inform people. IT leadership, executive management, possibly external incident response experts. And yes, the police—law enforcement agencies have specialized cybercrime units that can actually help.
Step three: Control communication. Before wild rumours circulate, you need an internal message. What do we tell employees? What do we tell customers? What do we tell the press if they call?
Step four: Don't pay hastily. Law enforcement agencies advise against ransom payments. You're financing criminal enterprises, you have no guarantee the key works, and you become a repeat target. Still, let's be honest: when the company's very existence is at stake, there are no easy answers. In such cases, professional negotiators should be brought in.
After the Storm: Rebuilding
Even when the acute phase is over, the real work begins. Compromised systems must not simply be "cleaned"—they need to be rebuilt from scratch. All passwords must be changed. And you should run heightened monitoring for at least 90 days, because attackers sometimes leave backdoors.
The most important step after any incident: the honest analysis. What went wrong? What worked? What do we change? Not as blame assignment, but as an investment in the future. Every company that survives an attack and learns from it comes out stronger than before.
The Uncomfortable Truth
Ransomware isn't going away. It's too profitable a business with too little risk for the perpetrators. The question isn't if you'll be attacked, but when. The only question you can influence is: how well are you prepared?
Start today. Check your backups. Activate MFA. Create an emergency plan that fits on two pages. These aren't unsolvable tasks—they're decisions you can implement by this Friday.
*We support you with ransomware prevention—from initial analysis to emergency planning. Schedule a conversation*
