Ransomware: Why Backups Alone Won’t Save Your Business

This is part 2 of our 8-week series, 8 Types of Cyber Attacks: one plain-English breakdown every Monday of how small businesses actually get hit, and what stops it.

You come in Monday morning and nothing opens. Every file on the shared drive has a strange new extension. QuickBooks won’t load. There’s a text file on every desktop explaining that your data has been encrypted, a copy has been stolen, and you have 72 hours to pay in cryptocurrency.

That’s ransomware. It isn’t a big-company problem. Verizon’s 2025 Data Breach Investigations Report found ransomware in 44% of all breaches, and in the large majority of breaches at small and mid-sized businesses. Attackers have figured out that small businesses are easier to get into and more likely to pay.

How ransomware actually gets in

Ransomware is the final step of an attack, not the first. By the time files get locked, the attacker has usually been inside for days or weeks. The most common ways in:

• Phishing. One stolen password or one malicious attachment is enough to get a foothold. (More on why those emails are harder to spot: Why phishing emails are getting harder to spot.)
• Exposed remote access. Remote Desktop open to the internet, or an old VPN without MFA, gets scanned and brute-forced around the clock.
• Unpatched firewalls and routers. Attackers go after known holes in edge devices, sometimes in bulk. We covered one example in Russia’s military hackers hijacked home-office routers across 23 states.
• Stolen or reused passwords bought from earlier breaches and tried against your Microsoft 365, VPN, or remote tools.

“Ransomware isn’t the break-in. It’s the bill. By the time you see the ransom note, they’ve been inside for weeks.”

— Glenn Kupsch, President, Adaptive IT

Why “we have backups” isn’t the whole answer

Backups are essential. But modern ransomware crews know you have them, and they plan around them:

1. They delete or encrypt the backups first. A backup drive plugged into the server, or a NAS on the same network with the same admin password, gets locked right along with everything else.
2. They steal the data before encrypting it. Restoring from backup gets you running again, but it doesn’t stop them from threatening to publish client records, payroll, or medical files. This is called double extortion, and it’s now standard practice.
3. Restores take longer than people expect. Rebuilding servers and pulling terabytes back from the cloud can take days. Most businesses have never actually tested how long.

Paying doesn’t reliably fix it either. Decryption tools are often slow or broken, stolen data doesn’t get “deleted,” and businesses that pay are more likely to be hit again. We break down the real numbers in The real cost of a ransomware attack on a small business.

What actually stops it

No single product prevents ransomware. Layers do, so one mistake doesn’t turn into a shutdown:

• MFA on every account, especially email, remote access, and admin logins. It shuts down most of the stolen-password routes in.
• Managed EDR with 24/7 monitoring. Modern endpoint protection like SentinelOne watches for ransomware behavior (mass file changes, backup deletion, credential theft) and can isolate a machine automatically before the damage spreads.
• Patching that actually happens, including firewalls, VPNs, and routers, not just Windows.
• Immutable, offsite backups that can’t be deleted or changed from your network, even with an admin password, plus regular test restores so you know how long recovery really takes.
• Least privilege. Staff don’t need to be local admins, and the account you use for email shouldn’t be the one that can wipe the server.
• A written incident plan. Who do you call, who talks to your cyber insurer, and what gets restored first? Many insurers now require this, and it’s a big part of getting through a cyber insurance audit.

Not sure where you stand?

Adaptive IT offers a Cyber Review for small businesses: a straightforward look at your backups, MFA coverage, endpoint protection, remote access, and the gaps an attacker would use first. You get a plain-English list of what to fix, in order.

Call the Adaptive IT service desk at (877) 958-1248 or get in touch here.

Next Monday in the series: Man-in-the-Middle attacks. How attackers quietly sit between you and the sites you trust, and why public Wi-Fi is only part of the story.