Cybersecurity · Singapore

Ransomware 101: what every small business owner should know

Ransomware isn't just a big-company problem — small businesses are frequently targeted precisely because they're assumed to have weaker defences. Here's what it is, and what actually stops it.

Quick answer Ransomware locks up your files and demands payment to release them. The best defence is layered: fewer ways in (MFA, patching, email security), fast detection on devices, and a tested backup so paying the ransom is never your only option.

What ransomware actually does

Ransomware is malicious software that encrypts your files — making them unreadable — and demands payment for the key to unlock them. It usually gets in through a phishing email, a compromised login, or an unpatched vulnerability, then spreads across connected systems before anyone notices.

Why small businesses are frequently targeted

Attackers often assume smaller businesses have fewer defences, less capacity to investigate an incident, and more pressure to pay quickly just to get operating again. That combination makes SMEs an efficient target, not an unlikely one.

The layered defence that actually works

Layer	What it stops
Email security	The phishing email that started it
MFA	A stolen password alone getting someone in
Patching	Known vulnerabilities being exploited
Endpoint protection	The encryption behaviour itself, once triggered
Tested backup	Being forced to pay because there's no other option

No single layer is enough on its own — the point is that each one covers where another might fail.

The single most important layer: a backup that's actually been tested. Every other layer is about prevention and detection; backup is what determines whether a successful attack is a bad day or a business-ending event.

The first hour, if it happens anyway

Disconnect affected devices from the network immediately, to limit spread
Don't power off encrypted devices — that can complicate recovery
Contact your IT/security provider immediately, not after trying to fix it yourself
Do not pay or negotiate without proper guidance

Having this plan written down before an incident — not improvised during one — is what separates a fast recovery from a chaotic one. See our guide on why "we have backups" isn't a full disaster recovery plan for what a complete plan actually needs.

FAQ

Questions, answered

Should we ever pay the ransom?

Paying doesn't guarantee your data is returned or that attackers won't target you again, and authorities generally advise against it. The far better position is not needing to make that decision at all, because a tested backup exists.

Why would attackers target a small business over a big one?

Smaller businesses are often assumed to have weaker defences and less capacity to recover on their own, which can make them a more attractive, lower-effort target — not a safer one.

How fast does ransomware actually spread?

Modern ransomware can encrypt a significant number of files within minutes of activating, which is why detection speed and automatic containment matter as much as prevention.