Imagine opening your office computer on a Monday morning in Kampala and finding that every invoice, customer record and accounting file has a strange new extension. A message on the screen says your files are encrypted and demands payment in cryptocurrency within 72 hours. This is ransomware, and it affects hospitals, schools, law firms, manufacturers and small shops around the world. This guide explains what ransomware is, how it spreads, and the practical steps you can take to protect your business and recover if the worst happens.
What is ransomware?
Ransomware is malicious software that blocks access to your data, usually by encrypting it, and then demands a ransom for the key to unlock it. Modern ransomware gangs often go further:
- Encryption: your files, databases and sometimes entire servers become unreadable.
- Data theft: before encrypting, criminals copy sensitive data and threaten to publish it if you do not pay. This is called double extortion.
- Pressure tactics: countdown timers, threats to contact your customers, or attacks on your website to force payment.
Even if a business pays, there is no guarantee that criminals will hand over a working key or delete stolen data. Paying also funds further attacks.
How ransomware gets into a business
Ransomware rarely appears by magic. It usually enters through a small, avoidable gap:
- Phishing emails: an attachment disguised as an invoice, delivery note or CV, or a link to a fake login page.
- Weak or reused passwords: attackers guess or buy passwords for remote access tools, email or admin panels.
- Exposed remote desktop: Remote Desktop Protocol (RDP) left open to the internet with weak passwords is a frequent entry point.
- Unpatched software: old versions of Windows, servers, VPNs or website plugins with known security holes.
- Pirated software and cracks: free downloads of paid programs bundled with malware.
- Infected USB drives: flash disks passed around offices, printing shops and cyber cafes.
- Compromised suppliers: an IT contractor or software provider with access to your systems gets hacked first.
Warning signs of a ransomware attack
Attackers often spend days inside a network before launching the encryption. Watch for:
- Antivirus being disabled without explanation
- New administrator accounts you did not create
- Unusual logins at odd hours or from other countries
- Computers suddenly running very slowly or disks very busy
- Files being renamed or appearing with unfamiliar extensions
- Large amounts of data being uploaded out of the network
If you notice these, act immediately. Early action can limit the damage.
How to protect your business from ransomware
1. Back up properly, and keep a copy offline
Backups are the most important defence, because they let you restore without paying. But ransomware often targets backups too. Use the 3-2-1 rule: three copies of your data, on two types of storage, with one copy offline or immutable, meaning it cannot be changed or deleted for a set period. Test restoring files regularly; an untested backup is just hope.
For websites and hosted email, choose a provider that keeps independent daily backups. Baasa Cloud hosting includes daily backups stored separately from your account, which makes recovery from a compromised site much faster.
2. Patch everything
Turn on automatic updates for operating systems and software. Pay special attention to anything facing the internet: VPNs, firewalls, email servers, remote access tools and website plugins. Replace systems that no longer receive security updates.
3. Lock down remote access
Never expose Remote Desktop directly to the internet. Use a VPN with two factor authentication for remote work, restrict access to staff who need it, and disable accounts that are no longer in use.
4. Use two factor authentication
Enable 2FA on email, remote access, cloud storage, accounting software and admin panels. Stolen passwords become far less useful.
5. Limit admin rights
Staff should use standard accounts for daily work. If a regular user opens a malicious file, the damage is far smaller than if they had full administrator rights.
6. Use endpoint protection
Install reputable antivirus or endpoint detection software on every computer and server, keep it updated, and make sure it cannot be easily switched off.
7. Filter email and train staff
Use email security that blocks dangerous attachments and links. Run regular, short awareness sessions so staff know how to spot suspicious messages and feel comfortable reporting mistakes quickly.
8. Segment your network
Separate guest Wi-Fi, office computers, servers and devices like CCTV cameras. If one part is infected, segmentation stops ransomware spreading everywhere.
What to do if ransomware hits your business
- Isolate infected devices. Disconnect them from the network and Wi-Fi immediately, but do not switch them off if you can avoid it, as evidence in memory may help investigators.
- Protect your backups. Disconnect backup drives and check that offline copies are safe.
- Call for help. Contact your IT provider or a cybersecurity firm with incident response experience.
- Report the incident. Report to the police. If personal data may be affected, take advice on your obligations under the Data Protection and Privacy Act, including notifying the Personal Data Protection Office where required.
- Do not rush to pay. Discuss options with professionals and legal advisers first. Some ransomware strains have free decryption tools available from security researchers.
- Restore from clean backups after the systems have been cleaned or rebuilt, and change all passwords.
- Learn from it. Identify how attackers got in and close that gap.
A ransomware readiness checklist
- Offline or immutable backup tested in the last month
- All systems on automatic updates
- No Remote Desktop exposed to the internet
- 2FA on email, VPN and admin accounts
- Staff using standard, not admin, accounts
- Endpoint protection on every device
- Written incident plan with phone numbers of who to call
Frequently asked questions
Can ransomware affect my website?
Yes. Attackers can encrypt or delete website files and databases, especially on poorly secured servers. Keep your CMS updated and use hosting with independent backups.
Does cloud storage protect me from ransomware?
Partly. Synced folders can upload encrypted files and overwrite good copies. Look for services with version history so you can roll back files to an earlier date.
Are Macs and phones safe from ransomware?
Most ransomware targets Windows systems and servers, but no platform is completely immune. Keep every device updated and backed up.
Conclusion
Ransomware is one of the most damaging threats a business can face, but it is also one of the most preventable. Reliable offline backups, prompt updates, secure remote access, 2FA and alert staff will stop most attacks or make recovery possible without paying a criminal. Start with your backups this week, then work down the checklist one item at a time.