Ransomware encrypts your files and systems and demands payment for the key — and attackers increasingly steal data first to add extortion pressure. The good news: the same handful of controls stop most attacks.
- Turn on multi‑factor authentication for email, remote access (VPN, RDP) and every admin account. Stolen passwords are the most common way in.
- Patch quickly, starting with internet‑facing systems: firewalls, VPNs, email servers and remote‑access tools.
- Keep immutable or offline backups — and test restores regularly. Attackers deliberately hunt for and delete reachable backups.
- Deploy EDR on every laptop and server so suspicious behaviour is detected and stopped, not just known viruses.
- Limit admin rights. Staff should not browse and read email with administrator accounts.
- Segment your network so one infected PC cannot reach every server.
- Prepare and practise a response plan: who decides what, who calls whom, and how you communicate — including breach notification duties.
If it happens
Disconnect affected devices from the network (unplug the cable or disable Wi‑Fi) but don’t switch them off or wipe them — evidence matters. Don’t contact the attackers or pay before getting expert advice. Then call your incident‑response provider.