What a Ransomware Attack Really Does to a Business

TL;DR: Ransomware is software that scrambles a company's files, then sells back the key that unscrambles them. The ransom is usually the smallest bill — downtime, lost customers and cleanup cost far more. Most businesses get back online from clean backups, not from paying.

Monday, 7:40 a.m. Your office manager opens the booking system and gets a text file instead. Every customer record, invoice and photo on the shared drive is now the same scrambled mess. A note says you have 72 hours to send $180,000 in Bitcoin.

That's a ransomware attack. It's not a movie plot. Dental offices, builders' merchants and law firms hit it every week.

How a ransomware attack actually unfolds

Nobody breaks in through a window. The usual routes are boring and well known:

• A staff member clicks a link in an email that looks like a delivery notice.
• A password gets reused on a site that leaked it years ago.
• A remote-access tool or VPN (the secure tunnel staff use to log in from home) hasn't been updated in two years.

The attacker then sits quietly for days or weeks. They copy files out first (customer lists, contracts, payroll), then encrypt everything. That's "double extortion": pay for the key, and pay again so your data doesn't get published.

Here's the bit people miss. The stolen copies don't come back even after you pay.

The bill goes far beyond the ransom

In 2021, Colonial Pipeline paid about $4.4 million to restore fuel deliveries across the US East Coast. The shutdown, not the payment, is what emptied petrol stations for days.

Same pattern everywhere. When Change Healthcare was hit in 2024, pharmacies couldn't check insurance for weeks. MGM Resorts' 2023 attack reportedly cost it around $100 million in lost business — the ransom was a rounding error next to that.

For a 20-person business, the maths looks like this:

• Days of lost trading while systems stay down.
• Staff paid to sit idle, or to rebuild spreadsheets by hand.
• Legal and IT forensics bills (experts who trace how the break-in happened), usually five figures.
• Customers who quietly move to a competitor and never come back.
• Insurance premiums that jump at renewal.

Should you pay? What the FBI says

Don't. That's the official US position, and it's practical too.

Paying funds criminal groups — some are under sanctions, which can make the payment itself illegal for a US company. Roughly a third of victims who pay never get a working key anyway. And a payer gets marked as a payer; repeat attacks are common.

So what works instead? Backups, done properly:

• Three copies of your data.
• On two different types of storage.
• With one copy offline or disconnected (a drive in a drawer counts).

Then test a restore. A backup you've never tried to recover is a hope, not a plan.

What this means for your business

You don't need a security team. You need a handful of habits, in this order:

• Turn on two-factor login (a code from your phone on top of your password) for email and remote access. It blocks most of these break-ins.
• Keep offline backups and restore one file, from one backup, every quarter.
• Patch internet-facing systems within days, not months.
• Give staff ordinary accounts, not admin ones.

Write a one-page plan with phone numbers: your IT person, your insurer, your lawyer. Print it. If your systems go down, you won't be able to look it up.

And read your cyber insurance policy now, before you need it. Many now require two-factor login and tested backups — skip those and a claim can be refused.

Key Takeaways

• Ransomware scrambles files and demands payment; attackers steal copies first.
• The ransom is rarely the biggest cost — downtime and lost customers usually are.
• Clean, offline, tested backups are what actually get businesses running again.
• Two-factor login and fast patching stop most attacks before they start.

Frequently Asked Questions