What is
ransomware?

• ▸ A phishing email or malicious attachment. Someone opens a convincing email and clicks a link or opens a file that quietly runs the attacker's software.
• ▸ A stolen or reused password. Attackers log straight in with credentials that were leaked, guessed or reused from another breach.
• ▸ Software that hasn't been updated (unpatched). Known weaknesses in out-of-date systems are a well-worn way in.
• ▸ Sometimes through a compromised supplier. A trusted vendor or connection that's already been breached can carry the problem to you.

One important twist: modern ransomware gangs often steal a copy of your data first before locking anything — a tactic known as "double extortion". Even if you can restore from backup, they threaten to leak your data unless you pay. That's why prevention matters as much as recovery.

• ▸ It encrypts your files and servers. Documents, spreadsheets, emails and databases are scrambled so nothing will open.
• ▸ It often spreads across the network. From one infected computer it reaches for shared drives, other machines and backups.
• ▸ It drops a ransom note. A message appears demanding payment (usually in cryptocurrency) in exchange for the key to unlock everything.

The result is that work grinds to a halt — no files, no systems, no trading. And paying is risky: it funds crime, it doesn't guarantee you'll get your data back, and the "decryption" tools attackers hand over are often slow or incomplete.

A tested, protected backup is what lets you recover without paying a cent — you simply restore your files and get back to work. The key words are tested and protected. Ideally your backup is kept offline or "immutable" so ransomware can't reach in and scramble it too. But a backup only counts if it actually works when you need it. Untested backups have a nasty habit of failing at the worst possible moment — the day you finally need them. Restoring from backup should be something you've practised, not something you're trying for the first time in a crisis.

1. Tested backups you can actually restore fromKeep protected, offline or immutable backups — and regularly practise restoring so you know they work.
2. MFA on every accountMulti-factor authentication stops a stolen password becoming a stolen business.
3. Keep software patched and up to dateApply updates promptly to close the known weaknesses attackers rely on.
4. Limit administrator accessThe fewer accounts with the "keys to everything", the less damage an intruder can do.
5. Train staff to spot the phishing that starts most attacksYour people are the first line of defence — a well-trained team catches the emails that get past the filters.
6. 24/7 monitoring to catch an intruder earlyRound-the-clock monitoring spots an attacker moving through your network before they can pull the trigger.

These measures line up closely with Australia's Essential Eight — the government-backed baseline of practical controls that stops the vast majority of attacks. It's a sensible framework to measure your business against.