For SMEs, ransomware is the most consequential form of cyberattack. A single successful attack can halt operations for days or weeks, and it hits companies of every size.
How an attack unfolds
Entry is usually through stolen credentials, unpatched internet-facing software or a phishing email. Attackers then often move undetected through the network for days, gain admin rights, look for backups and copy data. Only at the end do they encrypt systems and leave a ransom demand, combined with a threat to publish the stolen data.
What protects
The most effective measures are unspectacular: multi-factor authentication for all access, timely updates of internet-facing systems, restricted admin rights, an overview of your attack surface and above all backups following the 3-2-1 rule with a copy the attacker cannot reach or delete.
In an emergency
Disconnect affected systems from the network but do not shut them down, so traces are preserved. Activate the incident response plan and bring in forensic specialists and, where applicable, the insurer. Check reporting duties: the Swiss reporting obligation for critical infrastructure within 24 hours and data breach notification if personal data is affected. The Swiss federal cybersecurity office advises against paying ransom and recommends filing a criminal complaint. The first hours are described in our article ransomware in SMEs.