Last updated: 3 October 2026
Short answer: ransomware locks your files and demands payment to unlock them, and most attacks start with a phishing email, a stolen password or an unpatched system. If you are hit, isolate the affected devices, call your IT provider and insurer, and restore from clean backups. Law enforcement and the NCSC advise against paying.
How does ransomware work?
- Getting inA phishing email, a stolen or reused password, or an unpatched system gives the attacker a foothold.
- SpreadingThey move across your network, gain admin access and look for your most valuable data and your backups.
- Stealing dataMany attackers copy your files first, so they can threaten to publish them as well.
- EncryptingFiles, servers and sometimes backups are locked, and a ransom note appears.
- Demanding paymentYou are told to pay, usually in cryptocurrency, with a deadline to add pressure.
What should we do if we are hit by ransomware?
Act quickly and calmly. Disconnect affected devices from the network but leave them switched on, call your IT provider and your cyber insurer, and do not delete anything or pay without taking advice. Our guide to the first hour after a cyber attack walks through the steps in order. If personal data may be affected, you may need to tell the ICO within 72 hours.
How do we protect our business from ransomware?
| Protection | Why it helps | Cyber Essentials control |
|---|---|---|
| Multi-factor authentication | Stops stolen passwords being enough to get in. | User access control |
| Fast patching | Closes the holes attackers scan for. | Security update management |
| Endpoint protection | Blocks and flags malicious software. | Malware protection |
| Tested, separate backups | Lets you restore without paying. | Good practice |
| Firewalls and secure settings | Reduces what is exposed to the internet. | Firewalls, secure configuration |
| Staff awareness | Helps people spot phishing emails. | Good practice |
Can ABCOM help protect us from ransomware?
Yes. ABCOM provides layered protection for Sussex businesses: MFA, patching, endpoint protection, monitored backups and staff awareness, built around the Cyber Essentials controls. Book a free IT review and we will check how exposed you are.
Sources and further reading
Want this looked after for you?
ABCOM has supported Sussex businesses and charities since 1996 and is an NCSC Assured Service Provider – Cyber Advisor (Cyber Essentials). Talk to a real person about your IT.
Also read
How ABCOM can help
Talk to a real person at our Burgess Hill office. We are an NCSC Assured Service Provider and have supported Sussex businesses since 1996.