July 2026 7 min read Security

Don't Pay the Ransom Twice

A small business guide to ransomware: the warning signs, what to do in the first hour, and why paying is rarely the end of the story.

Ransomware cyber security attack.Data encryption threat protection.Cyber insurance and risk management.Digital network security breach alert.Businessman touching virtual warning screen.

Ransomware is no longer something that happens to large corporations and makes the national news. The attackers have moved downmarket on purpose. Small and medium businesses are targeted precisely because they have valuable data, limited IT resource, and a strong instinct to resolve the problem quickly and quietly.

The most common way in is depressingly ordinary: an email attachment that looked legitimate, a link in what appeared to be a supplier invoice, or a remote access service left open with a weak password.

Recognising the signs

Ransomware rarely announces itself politely. Things to watch for include:

Files that won't open

Documents suddenly fail to open, or ask for a password you never set.

Strange file extensions

Filenames ending in unfamiliar strings, or renamed entirely.

Ransom notes

Text or HTML files appearing in folders with instructions and a demand.

Sudden slowness or crashes

Systems struggling while encryption runs in the background.

Antivirus disabled

Protection switched off by something other than you.

Backups failing or deleted

Many attacks target your backups first, before the main systems.

The first hour: what to do

1

Disconnect, don't switch off

Pull affected machines off the network immediately. Avoid powering down unless advised — a running machine may still hold recoverable data in memory.

2

Protect your backups

If any backup is still connected, disconnect it now. Unaffected backups are the single most valuable asset you have.

3

Don't pay yet

Nothing about paying is improved by paying in the first hour and a great deal can be learned by not doing so.

4

Document everything

Note the time you noticed, what was displayed, which machines are affected. This matters for insurers and for any investigation.

5

Get expert advice

Speak to someone who deals with this professionally before you act. What looks like total encryption often isn't.

Note

If personal data has been affected, you may have obligations under UK GDPR, including notifying the Information Commissioner's Office within 72 hours where the breach is likely to result in a risk to people's rights and freedoms. Take advice on this promptly.

Why paying is often paying twice

The phrase in the title is not a slogan. It reflects what actually happens to a great many businesses that pay.

Payment is no guarantee of a decryption key. Some victims pay and receive nothing usable.
Keys that do arrive may only partly work, leaving a mixture of recovered and corrupted files that takes weeks to untangle.
Paying marks you as a payer. Repeat attacks against the same organisation are common.
Data may have been copied before encryption. Restoring your files does not remove the risk of it being published or sold later.
It funds the next attack on another business, quite possibly another one in your area.

Where professional recovery fits in

Ransomware recovery and data recovery are different disciplines, but they overlap more than people expect. In many cases we can recover substantial amounts of data from encrypted systems — particularly where encryption was interrupted, where only parts of a drive were affected, or where shadow copies, temporary files and deleted originals remain intact on the underlying storage.

This is why the advice not to power things down and not to start "cleaning" the machine yourself matters. Every subsequent write to a drive reduces what can be recovered.

Preventing the next one

Keep at least one backup offline and off-network. Cloud backup alone can be encrypted along with the source.
Turn on multi-factor authentication everywhere it's offered, especially remote access.
Patch promptly. Most attacks exploit flaws fixed months earlier.
Train the team on invoice and attachment scams. It remains the most common route in.
Have a written response plan so nobody is improvising at 7am on a Monday.

If you're dealing with an attack right now, call us before you take any further action. Early advice costs nothing and often changes the outcome considerably.

Hit by Ransomware?

Don't pay before you've spoken to us. We'll tell you honestly what can be recovered from your systems and what your options are.

Emergency Recovery 01423 622000