Protecting your business from ransomware, and getting your data back
Ransomware encrypts your files and demands payment. Good backups are the best protection, and fast action limits the damage.
Published 25 September 2026
How to reduce the risk
- Keep Windows, macOS, routers and NAS software up to date
- Use multi-factor authentication on email and remote access
- Train staff to spot suspicious emails and links
- Keep at least one backup offline or in a cloud service with version history
- Limit who has administrator access
If you are attacked
Disconnect affected computers from the network and the internet, but don't switch them off or wipe them until you have a plan, as that can destroy evidence and recoverable data. Don't connect your backup drives until you know the infection has been removed.
If personal data may have been affected, you may need to report the breach to the Information Commissioner's Office within 72 hours of becoming aware of it. You should also report the attack to the police.
Getting your data back
The safest route is restoring from a clean backup. Where backups are missing or were encrypted too, it is sometimes possible to recover earlier copies, snapshots or unencrypted fragments, depending on the ransomware and the storage. Bring the affected drives or NAS in and we will tell you honestly what is possible. See NAS recovery and RAID recovery.