A ransomware attack does not begin with a dramatic screen message. More often, it starts with an ordinary-looking email, a reused password, an unpatched device or a supplier account that has been quietly compromised. By the time files are encrypted, a small business may already be facing lost access to systems, missed customer work and a difficult decision about whether its backups can be trusted.

Current ransomware trends matter because criminals are adapting their methods around the way smaller organisations actually work. They know that many businesses rely on Microsoft 365, cloud software, remote access, shared files and a small number of people who wear several hats. That can make an attack disruptive very quickly, even where there is no large IT department to target.

Ransomware trends are moving beyond file encryption

The familiar version of ransomware encrypts files and demands payment for the key. That still happens, but it is no longer the whole story. Attackers increasingly steal data before they lock systems, then threaten to publish it if the organisation refuses to pay.

This is known as double extortion. It changes the risk from a technical recovery exercise into a wider business issue involving confidential information, client trust, contracts and regulatory obligations. A business with reliable backups may be able to restore its files, but it still needs to understand exactly what data was accessed and whether anyone outside the business needs to be notified.

Some groups also apply pressure in other ways. They may contact customers, employees or suppliers, or use stolen email accounts to make their threats appear more convincing. For a charity holding donor details, or an automotive business handling customer records and vehicle information, that can create a serious operational and reputational problem.

The practical lesson is simple: backups remain essential, but backups alone are not a complete ransomware defence.

Attackers are targeting identity first

Many attacks now start with a login rather than malicious software arriving directly on a computer. Criminals use phishing emails, fake Microsoft sign-in pages, password spraying and stolen credentials bought from other criminals. If they can gain access to an email account or remote management tool, they may be able to move through the business without immediately raising suspicion.

This is why multi-factor authentication is one of the most valuable controls a small business can put in place. A password on its own is too easy to guess, reuse or steal. Multi-factor authentication adds a second check, such as an authenticator app prompt, which makes a stolen password far less useful.

There are trade-offs. Multi-factor authentication can feel inconvenient, particularly for staff who share devices or move between sites. Poorly configured prompts can also lead to approval fatigue, where someone accepts a request without checking it. The answer is not to avoid the control, but to set it up sensibly, use phishing-resistant methods where appropriate and give staff clear guidance on what a genuine sign-in request looks like.

Smaller businesses are no longer overlooked

Ransomware groups are motivated by speed and profit. They do not need to attack a household-name company to make money. A smaller organisation may have fewer security controls, limited internal IT capacity and a greater immediate need to restore systems so that it can continue trading.

Automated scanning tools make this easier for criminals. They can search widely for exposed remote access services, outdated software or leaked passwords, then focus their effort on organisations that appear vulnerable. This means cyber security is not only a concern for businesses with large turnover or sensitive public profiles.

For Sussex businesses, the impact can be particularly acute where operations are locally connected. If a garage cannot access booking, parts or diagnostic systems, work can stop. If a professional office loses email and documents, client service slows immediately. If a charity cannot access supporter, finance or case-management records, staff may be unable to deliver services when they are needed most.

The cloud reduces some risks, but not all

Cloud services can improve resilience, but they do not remove the need for security and backup planning. Microsoft 365, for example, provides valuable infrastructure security and availability, but an attacker who gains access to a user account may still delete files, alter mailbox rules, send fraudulent emails or encrypt synchronised files.

Businesses should be clear about where responsibility sits. The software provider protects the underlying service; the business remains responsible for managing users, permissions, devices, data retention and recovery arrangements.

A separate backup for important cloud data is worth considering, especially for email, SharePoint, Teams and OneDrive. The right approach depends on how heavily those systems support daily operations, how long the business could manage without them and whether historic versions are needed for compliance or customer records.

Fast recovery depends on preparation, not payment

Paying a ransom is never a dependable recovery plan. There is no guarantee that criminals will provide a working decryption key, delete stolen data or avoid targeting the business again. Payment can also create legal, insurance and ethical complications.

A well-prepared business instead focuses on its ability to contain the incident and restore safely. That means having backups which are isolated from the normal network, tested regularly and protected with separate credentials. A backup that has never been restored is an assumption, not a recovery plan.

Recovery priorities should be agreed before an incident. Most businesses do not need every system restored in the same order. They need the systems that allow them to serve customers, communicate with staff, take payments and access essential records. Knowing that order saves valuable time when pressure is high.

A practical ransomware response plan should cover at least these five areas:

• who has authority to make urgent decisions and contact suppliers;
• how affected devices will be isolated without destroying evidence;
• how staff, customers and insurers will be kept informed;
• which systems and data must be recovered first; and
• how the business will verify that restored systems are safe to use.

The plan does not need to be a thick document that nobody reads. A short, tested set of actions and contact details is more useful than a policy left in a shared folder that cannot be reached during an outage.

Phishing remains effective because it exploits pressure

Despite better technical controls, phishing still works because it targets people at busy moments. An invoice that appears to come from a known supplier, a delivery notification, a password-expiry message or an urgent request from a director can all create enough pressure for someone to act before thinking.

Staff training should be regular, practical and blame-free. People need to know how to spot unusual requests, report them quickly and ask for help without feeling embarrassed. Reporting a suspicious email is a positive action, even if it turns out to be genuine.

Technical safeguards should support staff rather than rely on them being perfect. Email filtering, attachment controls, web protection and clear procedures for changing bank details all reduce the chance that one convincing message becomes a major incident.

Security basics still make the biggest difference

The most useful response to ransomware trends is not chasing every headline or buying a collection of disconnected security tools. It is getting the foundations right and keeping them working.

That includes keeping computers, servers, firewalls and business applications updated; removing old accounts promptly; giving users only the access they need; securing administrator accounts; monitoring devices; and reviewing backups. It also means understanding what technology is actually in use. Forgotten laptops, former staff accounts and unsupported software are common weak points.

For organisations with limited time, an independent IT review can turn this into a manageable plan. My Tech Team helps businesses identify the areas that most affect continuity, then puts practical protections and support arrangements in place without burying decision-makers in jargon.

Ransomware is unlikely to disappear, but it does not have to become a business-ending event. The most reassuring position is one where your people know what to report, your systems are monitored and protected, and your business can recover in a controlled way if the worst happens. A no-obligation IT audit is a sensible place to start if you are unsure whether those basics are in place.