Ransomware prevention: How attacks happen and how to stop them

Knowing how to prevent ransomware comes down to closing a short list of doors. Most attacks get in through an unpatched system facing the internet, a stolen password on an account without MFA, or someone tricked into running a file. Close those, keep backups the attacker can’t touch, and you can recover without paying.

Ransomware was involved in 48% of the breaches in Verizon’s 2026 Data Breach Investigations Report, up from 44% a year earlier, and Verizon says small organizations are hit disproportionately.

How ransomware gets in

Ransomware locks your files or systems, usually by encrypting them, so the attacker can demand payment for the key. Most groups now copy your data first and threaten to publish it, and some skip the encryption entirely. Much of it runs like a business: ransomware-as-a-service groups rent their tools to affiliates who break in and split the payout. The most commonly reported variants to the FBI in 2025 included Akira, Qilin, INC/Lynx, BianLian and Play, and the FBI noted healthcare as one of the sectors hit hardest.

The ways in are rarely exotic:

• Unpatched internet-facing systems. Exploiting software flaws is now the most common way in, at 31% of breaches in Verizon’s data, ahead of stolen credentials. Firewalls, VPNs and remote access tools are favorite targets.
• Stolen or guessed passwords on email, remote desktop or VPN accounts without multi-factor authentication.
• A convincing email, text or phone call that gets someone to open an attachment, sign in to a fake page or let a fake help desk tech connect.
• Fake updates and fake fixes. A trick Microsoft calls ClickFix shows a fake CAPTCHA or error that tells the user to paste a command into the Windows Run box.
• Remote desktop left open to the internet.
• Vendors and IT tools with access to your network, if their accounts are compromised.

Ransomware prevention checklist: eight controls

The FBI and CISA recommend largely the same list. For an organization of 10 to several hundred people, it comes down to these, roughly in order of payoff.

1. Patch fast, starting with anything facing the internet, and replace equipment that no longer gets updates.
2. Require MFA on email, remote access, VPNs, admin accounts and backups. Phishing-resistant options like passkeys are best.
3. Limit admin rights. Use separate admin accounts and give staff only the access their job needs.
4. Run endpoint detection and response with 24/7 monitoring. The FBI specifically recommends EDR for catching attackers moving between machines, and a security operations center that can isolate a device at night is what turns a breach into a near miss. Every one of our clients has one.
5. Use application control, so unapproved programs, including fake updates, can’t run even if someone clicks.
6. Filter email and web traffic, and train staff with phishing simulations that cover fake CAPTCHA tricks.
7. Segment the network so one infected PC can’t reach every server.
8. Close remote desktop to the internet and use secure remote access instead.

Backups that survive an attack

Attackers know backups are your way out, so they go after them first. A backup that is always connected to the network, or that uses the same admin password as everything else, often gets encrypted or deleted along with your files. The FBI and CISA both recommend encrypted, offline backups. Keep at least one copy offline or immutable, keep copies in more than one place, protect backup systems with separate credentials and MFA, and test restores on a schedule.

For our clients, server backups run every hour, a copy goes off-site every day to storage in the US, the backups are immutable so no one can alter or delete them, and they are verified with screenshots. Backups are one piece of a business continuity plan, which also covers who makes decisions and how you keep working. Our post on secure data backup goes further.

Microsoft 365 needs its own backup

If an attacker takes over an account, or ransomware runs on a laptop that syncs with OneDrive, encrypted files sync to the cloud like any other change. Microsoft documents that SharePoint and OneDrive keep at least 500 versions of each file by default, deleted files stay in the recycle bin for 93 days, and libraries can be rolled back to any point in the last 30 days. Deleted email can be recovered for 14 days by default, extendable to 30. Those windows are short and depend on the attacker not having admin rights, so a separate backup, such as Microsoft 365 Backup or another dedicated service, gives you restore points you control. For our clients, Microsoft 365 and Google Workspace data is backed up three times a day to immutable storage.

If ransomware hits anyway

1. Isolate affected devices from the network, without wiping or powering them off.
2. Call your IT provider and your cyber insurer. Many policies require their approved response firms.
3. Reset passwords and revoke sessions for admin and affected accounts from a clean device.
4. Report it to the FBI through ic3.gov or your local field office.
5. Work out what was taken as well as what was encrypted, because that drives notification.
6. Restore from clean backups only after the attacker is removed.
7. Talk to counsel before any payment decision. The U.S. Treasury warns that paying certain groups can violate sanctions, and paying doesn’t guarantee your data comes back or stays private.

Your response plan should name who makes these calls. Our compliance services help build that plan, and our data breach response guide covers the first hours in detail. If you are unsure whether you are facing ransomware or another infection, see malware vs ransomware.

Test whether your backups would survive an attack on a quiet day. Across all of our clients, we have had zero ransomware events, zero malware outbreaks and no reportable data breaches. Book a 15-minute call and we’ll look at your setup with you, as part of our cybersecurity services.

Related reading: What does cyber insurance cover (and what doesn’t it)?, UPS battery backup: What every small office should know and IT disaster recovery plan: Why your IT partner shouldn’t go silent.

Frequently asked questions

What is ransomware?

Ransomware is malicious software that locks your files or systems, usually by encrypting them, so the attacker can demand payment for the key. Most groups now copy your data first and threaten to publish it, and some skip the encryption entirely.

How does ransomware work?

An attacker gets in, most often through an unpatched system facing the internet, a stolen password on an account without MFA, or someone tricked into running a file. They copy your data, encrypt what they can reach, including connected backups, and demand payment. Many groups rent their tools to affiliates who do the break-in and split the payout.

How do you prevent ransomware?

Patch anything facing the internet first, require MFA on email, remote access and admin accounts, and limit admin rights. Run endpoint detection and response watched 24/7, block programs you haven’t approved, and keep at least one tested backup offline or immutable. Those backups are what let you recover without paying.