Ransomware (once called a cryptolocker) gets in through phishing, stolen passwords on accounts without multi-factor authentication (MFA), unpatched internet-facing devices such as VPNs and firewalls, and exposed remote desktop. Attackers usually steal data before encrypting it. Your recovery depends on backups the attacker can't reach or delete, tested restores and a written response plan. UK law enforcement advises against paying, and the government plans to ban payments by public bodies.
What does ransomware look like in 2026?
The old cryptolocker simply scrambled your files and asked for money to unlock them. Modern ransomware groups run a business model called double extortion: they copy your data first, then encrypt your systems, then threaten to publish what they stole if you don't pay. Backups solve the encryption problem, but not the leak.
The headline numbers can mislead. Only 1% of UK businesses reported a ransomware attack in the government's 2026 survey, down from 3%. But when it happens it's the most damaging thing most businesses will face. Microsoft found that over half of cyber attacks with a known motive were driven by extortion or ransomware, and the NCSC handled 204 nationally significant incidents in the year to August 2025, more than double the year before.
Scotland has seen what this looks like. The Scottish Environment Protection Agency was hit on Christmas Eve 2020, refused to pay, and had more than 4,000 stolen files published. Recovery took many months. That's a public body with a large IT team; a 30-person business has far fewer people to absorb the shock.
How does ransomware actually get in?
Phishing. An email tricks someone into entering their Microsoft 365 password on a fake page, or opening an attachment that installs a remote-access tool. Our phishing guide covers this in detail.
Stolen or guessed passwords on accounts without MFA. Passwords from old breaches are tried against email, VPNs and remote desktop. One account without MFA (a second check when someone signs in) is enough.
Unpatched internet-facing devices. Firewalls, VPN gateways and file-sharing servers are attacked within days of a flaw being published. The NCSC reported that three vulnerabilities, in Ivanti, Fortinet and Microsoft SharePoint products, drove 29 of the incidents it handled in 2024–25. That's why Cyber Essentials now makes 14-day patching an automatic-fail requirement.
Exposed remote desktop (RDP). A server with remote desktop open to the internet is found by automated scanners within hours.
Suppliers and remote access tools. An IT supplier, software vendor or contractor with remote access to your network can be a way in if their own security is weak. Ask them how they protect it.
USB sticks and malicious downloads still happen, but they're now a minor route compared with these.
What does an attack look like, hour by hour?
This timeline is illustrative, based on a typical pattern for a small business. Real attacks can move faster or sit quietly for weeks.
| When | What the attacker does | What would have stopped it |
|---|---|---|
| Day 1, 10:15 | A sales manager enters her password on a fake Microsoft login page | Passkeys or phishing-resistant MFA; email security warning banners |
| Day 1, 10:20 | Attacker signs in from abroad; there's no MFA on her account | MFA; Conditional Access blocking non-UK sign-ins |
| Day 1–12 | Reads email, sets a hidden forwarding rule, finds the IT admin's details, sends an internal phishing email that captures an admin password | Alerts on new forwarding rules; separate admin accounts with passkeys |
| Day 13, 23:00 | Uses the admin account to reach the file server, disables antivirus, copies 40GB of client and HR data out | EDR that alerts on tampering; a 24/7 security operations centre watching overnight |
| Day 13, 02:00 | Deletes backups it can reach, then launches encryption across the server and laptops | Immutable, off-network backups the admin account can't delete |
| Day 14, 08:30 | Staff arrive to ransom notes on every screen and no access to files, email archives or the accounts system | A tested response plan and restores that take hours, not weeks |
The pattern matters more than the times. There's almost always a gap between getting in and pulling the trigger, and that gap is where monitoring earns its keep.
What backups actually survive ransomware?
Attackers go after backups first, because a business with good backups doesn't need to pay. So the question isn't "do we back up?" but "could an attacker with our admin password delete our backups?"
The long-standing 3-2-1 rule is the starting point: three copies of your data, on two different types of storage, with one copy off site. Add two refinements. At least one copy should be immutable or offline, meaning it can't be changed or deleted for a set period, even by an administrator. And there should be zero errors in restore tests: back up nothing you haven't proved you can restore.
Microsoft 365 needs its own backup. Microsoft keeps the service running, but deleted or encrypted mailboxes, OneDrive and SharePoint files are your responsibility, and version history has limits. Decide how much data you can afford to lose (hours or a day?) and how quickly you need each system back, then check that your backups actually meet those targets. Test a full restore of something important at least twice a year.
What should be in a ransomware response plan?
Only 25% of UK businesses have a formal incident response plan (DSIT, 2026). It doesn't need to be long, but it needs to exist on paper, outside your IT systems, with phone numbers. The first hour should look like this:
- Isolate, don't switch off. Unplug affected devices from the network or turn off WiFi, but leave them powered on for investigation.
- Call your IT provider or incident response contact, then your cyber insurer, whose policy may require you to use their appointed responders.
- Change passwords and revoke sessions from a clean device, starting with admin accounts.
- Preserve evidence. Don't wipe or rebuild anything until you've agreed the approach with your responders.
- Report. Police Scotland on 101 (or Report Fraud elsewhere in the UK), and the ICO within 72 hours if personal data may have been affected. Small Scottish organisations can also call the Cyber and Fraud Centre – Scotland helpline on 0800 1670 623.
Decide in advance who talks to staff, customers and the press, and how you'll keep trading without email or files for a few days.
Should you pay the ransom?
UK law enforcement and the NCSC "do not encourage, endorse, nor condone" paying. Payment doesn't guarantee your files come back or that stolen data is deleted, it marks you as willing to pay, and paying a sanctioned group can itself be illegal.
The government is going further. After a 2025 consultation it confirmed plans to ban ransom payments by public sector bodies and regulated critical national infrastructure, to require other organisations to notify the government before paying, and to introduce mandatory reporting of ransomware incidents (a 72-hour initial report is under consideration). In February 2026 these measures were still being developed alongside the Cyber Security and Resilience Bill, which as of September 2026 was at report stage in the House of Lords and not yet law. Private businesses can still legally pay, subject to sanctions rules, but the direction is clear.
For most small businesses the practical answer is to make paying unnecessary: backups you can restore, and data that's been limited and encrypted so a leak does less harm.
How Indigo does this. Indigo Unified Communications runs Kaseya 365 Endpoint detection and response on every managed device, protecting each one against viruses and ransomware. We monitor and patch devices through Datto RMM, and back up Microsoft 365 separately with Datto SaaS Protection. Our Platinum and Charity packages add a dedicated security team watching your systems 24/7 (a security operations centre, using RocketCyber) that can isolate an infected device at any hour. vPenTest vulnerability testing finds weaknesses before attackers do. Our Glasgow and Livingston engineers manage 2,000+ endpoints. Cyber security →
What to do next
- Check MFA on every account, especially admins, email and remote access.
- Close exposed remote desktop and confirm your firewall and VPN firmware are fully patched.
- Ask your IT provider one question: could someone with our admin password delete our backups? If the answer isn't a clear no, fix it.
- Run a test restore of an important system and time it.
- Write a one-page response plan with phone numbers, print it and keep a copy off site.
Frequently asked questions
What is a cryptolocker?
CryptoLocker was an early ransomware strain from 2013, and the name stuck as a general term for ransomware that encrypts files and demands payment to unlock them. Modern ransomware works the same way but usually steals data first, then threatens to publish it, so backups alone no longer remove all the leverage.
Is it illegal to pay a ransom in the UK?
For most private businesses, not currently, unless the payment goes to a sanctioned person or group, which is an offence. The government plans to ban payments by public bodies and critical national infrastructure, and to require others to notify it before paying. Law enforcement advises against paying in all cases.
Will antivirus stop ransomware?
Not reliably on its own. Traditional antivirus looks for known threats, while ransomware groups use new variants and often disable antivirus first. Endpoint detection and response watches for suspicious behaviour, such as mass file encryption, and can stop it and isolate the device. A 24/7 security operations centre adds people watching those alerts overnight.
Do we need to back up Microsoft 365?
Yes. Microsoft keeps its service running, but it isn't a backup of your data. If a mailbox or SharePoint library is deleted, encrypted or corrupted, retention and version history have limits. A separate Microsoft 365 backup, kept outside your tenant (your organisation's own Microsoft environment), lets you restore data to a point before the attack.
Sources: DSIT, Cyber Security Breaches Survey 2025/2026, 30 April 2026 (https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026) · Microsoft, Microsoft Digital Defense Report 2025, 16 October 2025 (https://blogs.microsoft.com/on-the-issues/2025/10/16/mddr-2025/) · NCSC, Annual Review 2025: incident management, 14 October 2025 (https://www.ncsc.gov.uk/collection/ncsc-annual-review-2025/chapter-01-cyber-threat-to-the-uk/incident-management) · NCSC, Mitigating malware and ransomware attacks (https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks) · Goodwin, The UK's ransomware strategy: what the government's response signals, February 2026 (https://www.goodwinlaw.com/en/insights/publications/2026/02/alerts-technology-dpc-the-uks-ransomware-strategy) · Infosecurity Magazine, UK confirms ransomware payment ban for public sector and CNI, 22 July 2025 (https://www.infosecurity-magazine.com/news/uk-ransomware-payment-ban-public/) · UK Parliament, Cyber Security and Resilience (Network and Information Systems) Bill, bill stages, accessed September 2026 (https://bills.parliament.uk/bills/4035) · Computer Weekly, SEPA data leaks as agency resists ransom demands, January 2021 (https://www.computerweekly.com/news/252495218/Sepa-data-leaks-as-agency-resists-ransom-demands) · Cyber and Fraud Centre – Scotland, Incident response (https://cyberfraudcentre.com/community/incident-response).
Related: Cyber security · Managed IT support · Phishing · Cyber Essentials explained · Renewables guide: cyber security
How secure is your business, really?
Book a free security review. We'll check your Microsoft 365, devices and backups against Cyber Essentials and give you a short list of fixes.