Ransomware and Small Businesses: What It Means for Your Website

Ransomware is malicious software that encrypts a victim's files, or steals them, and demands payment for their return. It is often associated with large organisations, but small businesses are common victims because they tend to have fewer defences, and attackers use automated tools that do not care how big a company is. A website or server can be part of that picture, either as a target or as a way in.

How ransomware reaches a business

• Phishing emails with malicious attachments or links, opened on a staff computer.
• Stolen or weak credentials for remote access services, such as remote desktop or VPN, or for the hosting control panel.
• Unpatched software on computers, servers, routers and websites, which attackers scan for automatically.
• Compromised websites that serve downloads or scripts to visitors.
• Supply-chain problems, such as infected plugins or software updates.

Once inside, the attacker may spend days exploring, copying data and deleting backups before triggering the encryption. Many groups now also threaten to publish stolen data, so having a clean backup helps with recovery but does not remove that second threat.

What it means for a website

Websites are affected in three ways. First, a compromised admin computer or a stolen credential can give attackers access to your hosting account, from which they can delete or encrypt site files and backups stored in the same account. Second, a vulnerable site on a server can be used as the foothold that leads to other systems on the same machine or network. Third, your site or your mailing list may be used to spread malware to your own customers, which is a reputational harm on top of the direct loss.

Prevention: reduce the chances

1. Keep everything updated: operating systems, browsers, CMS, plugins, routers, and server software.
2. Use strong, unique passwords and 2FA on email, hosting, domain, remote access and admin accounts.
3. Limit privileges. Staff should not use administrator accounts for daily work. Give website users only the roles they need.
4. Protect email. Use spam and malware filtering, train staff to spot suspicious messages, and set up SPF, DKIM and DMARC so your own domain is harder to spoof.
5. Close unused doors. Disable remote access you do not need, restrict admin interfaces by IP, and remove old accounts and software.
6. Use endpoint protection on computers that manage the website.
7. Segment where you can, so that one infected computer or site does not give access to everything.

Backups: your strongest recovery tool

If files are encrypted, a clean backup lets you rebuild without paying. For that to work, backups must survive the attack:

• Follow the 3-2-1 rule, with at least one copy off-site and out of reach of your normal credentials.
• Prefer immutable or versioned storage, so an attacker who gains access cannot overwrite or delete earlier versions.
• Do not leave backup drives permanently connected to the computer they back up.
• Test restores regularly. An encrypted, corrupted or incomplete backup is no help.

If you are hit

1. Isolate. Disconnect affected computers from the network and, if a server is involved, take the site offline or block access. Do not switch devices off if you may need forensic evidence in memory, unless advised otherwise.
2. Preserve evidence. Photograph the ransom note, keep the sample files and note the times.
3. Contact your host and any IT support immediately, so they can check other systems on the account and block attacker access.
4. Change credentials from a clean device: email, hosting, domain, CMS, SFTP, database, and any API keys.
5. Identify and close the entry point before restoring, or you will be hit again.
6. Restore from a clean backup made before the compromise, onto clean systems.
7. Report it. Many countries have a national cyber security authority and police reporting channel, and data protection law may require notifying the regulator and affected people when personal data is involved. Check the rules that apply in your country.

Should you pay?

Authorities generally advise against paying. There is no guarantee you will get working decryption tools, payment funds further crime, and it can mark you as willing to pay again. The decision belongs to you, ideally with professional advice, and it is much easier to refuse when you have a tested backup. Whatever you decide, note that paying does not remove the need to find out how the attacker got in.

Email and domain: the forgotten pieces

Ransomware crews and other criminals often start with email. A compromised mailbox lets them read password reset messages, impersonate staff and send convincing phishing to your customers. Protect your business email with strong authentication and filtering, and publish SPF, DKIM and DMARC records for your domain so receivers can reject forged messages. Our article on business email hosting explains how those records work together.

Also keep a short offline record of how to reach key suppliers: your registrar, hosting provider, bank and insurer. If your computers are encrypted, you may not be able to read the email that contains their numbers. A printed one-page contact sheet and a written recovery plan, kept somewhere safe, can save hours on a bad day.

Cyber insurance and legal duties

Some small businesses carry cyber insurance, which can cover response costs. Read the policy now, because insurers often require specific controls such as multi-factor authentication and tested backups, and may require you to contact them before you hire anyone. Separately, if personal data is affected, you may have a legal duty to report it within a fixed period. Knowing these obligations before an incident means you can act quickly.

A calm, boring defence works

Most ransomware prevention comes down to routine habits: updates, unique passwords, 2FA, restricted access and tested backups. Zebra Hosting Cloud plans use Plesk, where you can manage backups and users separately for each site; see the security page for more on how we approach protection.