Ransomware: how SMEs get attacked and how to respond

There is a dangerous, widespread idea: “we are small, nobody is interested”. The reality is the opposite. Ransomware groups attack SMEs precisely because they typically have fewer controls, less security staff and less room to survive a shutdown that lasts days or weeks. The extortion is collected in hours; the damage is paid for months.

This guide is not alarmism: it is the real mechanics of the attack and the plan you should have before you need it.

What ransomware is and why you get picked

Ransomware is malicious software that encrypts your files and then demands a payment to give you access back. That business model works on two levels: the more critical the system, the more pressure to pay; and the less prepared the company, the more likely it ends up paying.

Today, professional groups combine encryption with data theft: they copy your information before locking it and then threaten to publish it if you do not pay. This is known as double extortion, and it works even if you restore your backups — because the threat is not the encryption, it is the leak.

How they get in (it is almost never “hacking”)

Getting in does not require a sophisticated attack against you. An open door is enough:

• Remote desktop exposed to the internet without MFA. This is the number one route: your server's login screen is visible from anywhere in the world, protected by a password alone.
• Phishing with attachments or links. A file that looks like an invoice, a “security update”, a CV… The click runs it all. We cover this in detail in spotting targeted phishing.
• Stolen and reused credentials. The same password across services eventually appears in a breach: they get in and check whether it works. This is exactly what happened in the Snowflake incident.
• Unpatched vulnerabilities. Critical flaws are exploited years after a patch exists; we covered five of them in this article.
• Third parties and suppliers. A shared access with your accountant, your IT provider or your agency becomes your door if they get compromised.

What happens during the attack

A successful attack follows a fairly predictable script:

1. Access and lateral movement. They come in through one door and from there hunt for servers, backups and accounts with more permissions.
2. Data theft. They export what matters: billing, records, bank details, customer data.
3. Defences disabled. Antivirus stopped, logs wiped, backups encrypted or deleted.
4. Encryption and extortion. They lock systems and give you a deadline with a figure. Sometimes they “negotiate”; almost always the price goes up.

The real damage is almost never the ransom: it is the days of downtime, the customers who leave, the lost revenue and the cost of rebuilding everything in a hurry.

To pay or not to pay? Almost never the answer

• It guarantees nothing. Some groups do not deliver the keys, or deliver them badly. You pay and they ask for more.
• It funds and flags you. Getting on the “pays up” list turns you into a repeat target.
• It can be illegal. If the group is under international sanctions, paying them may breach sanctions regulations.
• And it fixes nothing. If you do not close the door they came through, they will visit again.

What really protects you

You do not need an enterprise budget. These six controls drastically reduce the problem:

• Tested 3-2-1 backups. Three copies, on two different media, one offline or outside the network. And above all: do a real test restore — do not trust “it should work”.
• MFA on every remote access. Remote desktop, VPN, email, admin panels. Without it, your password is the only lock.
• Patch what is visible from the internet. VPN, servers, firewalls, web. They are the targets of the first wave.
• Segment the network. Keep the admin computer off the same network as the front desk. And keep backups unreachable with day-to-day credentials.
• Clean accounts. No old users with access, no shared credentials, no admin rights for everyone.
• Monitor and rehearse. Alerts for unusual logins and an annual “what do we do if everything gets encrypted?” drill.

If you get hit: the first 60 minutes

1. Isolate what is affected. Disconnect compromised machines from the network. Do not just power them off: you can destroy useful evidence. If in doubt, ask before touching.
2. Do not delete or reinstall anything. The incident scene is your best information on how they got in.
3. Gather the team and call professionals. Management, IT and legal advisor. If you have no in-house expert, now is the time to call one.
4. Report it. A police report activates potential support and international cooperation. In Spain you can also report incidents to INCIBE.
5. If personal data is compromised, assess notifying the AEPD within 72 hours — it is a legal duty under GDPR; a breach falls within your obligations.
6. Restore from clean backups and rotate credentials. Only after understanding what happened and closing the entry point.

Prepare before it happens

No small company can afford to improvise its way through a system hijack. What makes the difference is not what you do during the attack, but what you prepared beforehand: backups that restore, MFA active, remote access closed and a one-page plan with the phone numbers to call.

If you do not know where to start, your first step is seeing what your company looks like from the outside. Our free OSINT audit delivers that in a report within 72 hours, without accessing your systems. And if you want to test the real resilience of your network, we do it with penetration testing authorised in writing.