It Starts With Something Small
Let’s talk about a business owner we’ll call Dana. Dana runs a small accounting firm with eight employees and a few hundred clients. It’s a Tuesday morning, and she’s sipping her coffee when her office manager pops in: “Is the shared drive acting weird for you?”
At first it’s little things. A file won’t open. The server feels sluggish. Someone’s laptop restarts on its own. Then file names start changing to strings of gibberish with an extension nobody recognizes. One by one, the computers in the office stop cooperating.
By lunch, everything is locked. Client tax returns, payroll files, the scheduling system, years of records. All of it is encrypted and unreadable.
Then a message appears on every screen.
This story is a composite, not one specific client. But every piece of it happens to real small businesses every single day. And the feeling that washes over you in that moment? That pit in your stomach is very, very real.
So What Is Ransomware, Exactly?
Ransomware is malicious software that locks up your files and systems so you can’t use them, then demands money to give them back. Think of it as someone breaking into your office, changing every lock, and slipping a note under the door with their price.
It usually gets in through a door we leave open without realizing it: a phishing email someone clicked, a reused or stolen password, remote access left exposed to the internet, or software that hasn’t been updated. (If you’ve been following our phishing posts, you already know how convincing that first email can be.)
Here’s the part most people don’t realize. By the time you see the encryption, the attackers have often been inside your systems for days or even weeks. They’ve been quietly looking around, finding your most valuable data, and copying it out. The locked screens are the finale, not the opening act.
The Note That Changes Everything
The message on Dana’s screens is short and cold. Her files are encrypted. The attackers also have copies of her data, including client records. If she pays, they’ll hand over a key to unlock everything and “delete” what they took. If she doesn’t, the files stay locked, and her clients’ information gets published online or sold. There’s a countdown timer. There’s a cryptocurrency wallet address.
This is called double extortion, and it’s now the standard playbook. It used to be that good backups could save you. Attackers figured that out, so now they steal your data first. Even if you can restore your systems, they still have leverage: your clients’ Social Security numbers, bank details, and private information.
And this is where the fear really sets in. It’s not just “Can I get my files back?” It’s:
- What do I tell my clients?
- Is my business going to survive this?
- Did I do something wrong?
- Who do I even call right now?
If you ever find yourself here, take a breath. Panic is exactly what the attackers are counting on. The countdown timer exists to rush you into a decision before you’ve thought it through.
Two Doors, Neither of Them Great
Once the shock wears off a little, it comes down to two choices.
Option 1: Pay the ransom. It sounds like the quick fix, but there are no guarantees. You’re trusting criminals to keep their word. The decryption key may not work, or may only unlock some files. Paying doesn’t mean your stolen data actually gets deleted. And businesses that pay often get marked as willing payers and targeted again.
Option 2: Don’t pay, and try to restore. This means rebuilding from backups and cleaning up your systems. It’s the path law enforcement encourages. But it only works if your backups are recent, complete, and weren’t encrypted along with everything else. (Attackers go looking for your backups on purpose.) Even then, restoring takes time, and the stolen data is still out there.
There’s no one-size-fits-all answer here. Which is exactly why the next step isn’t choosing a door. It’s getting help.
First Move: Call in the Professionals
I’ll say this as plainly as I can: this is not a DIY situation. I know we founders love to figure things out ourselves. Not this time.
Here’s who needs to be in the room, fast:
- An incident response team. These are cybersecurity professionals who handle ransomware for a living. They’ll contain the damage, figure out how the attackers got in, check whether your backups are usable, and help you understand your options. If you have cyber insurance, call your carrier first. Most policies require you to use their approved responders.
- Law enforcement. Report it to your local FBI field office and through the FBI’s Internet Crime Complaint Center at ic3.gov. You can also report to CISA. The FBI sometimes has decryption keys from past investigations or intel on the specific group targeting you.
- A lawyer. Depending on what data was taken and where your clients live, you may have legal obligations to notify clients, regulators, or both, often on a tight deadline.
A few things not to do while you wait: don’t wipe or reboot everything (you could destroy evidence), don’t reach out to the attackers on your own, and don’t try to negotiate solo. Unplug affected machines from the network, document what you see, and let the pros lead.
“Wait, Do I Have Cyber Insurance?”
This is the question that hits right after the panic. For a lot of small businesses, the answer is no. And honestly? You should have it. A good policy can pay for incident response, legal help, client notification, and lost income while you’re down.
But even if you have it, don’t assume you’re fully covered. Ransomware is one of the most expensive claims insurers see, and policies have gotten a lot pickier. Common gotchas include:
- Caps on ransom payments that are lower than your overall policy limit
- Sanctions exclusions, meaning they won’t pay if the attackers are on a government sanctions list (more on that next)
- Required vendors, where using your own IT person instead of their approved team can jeopardize your claim
- Tight reporting windows, so waiting a few days to call them can cost you coverage
- Security requirements like multi-factor authentication or backups that you said you had on your application. If you didn’t actually have them in place, your claim may be denied.
If you have a policy, pull it out this week and read the ransomware section. If you don’t, talk to a broker about one. Either way, you want to know your coverage before the note appears, not after.
Can You Even Pay? Two Very Different Questions
Even if you’re leaning toward paying, there are two big hurdles.
Can you afford it? Ransom demands are often sized to what attackers think you can pay. They’ve been in your systems, remember. They may have seen your bank balances and your insurance policy. For a small business, the demand alone can be more than you have in the bank. And the ransom is only part of the bill. Add in incident response, legal fees, client notification, downtime, and lost clients, and the total cost is often far bigger than the ransom itself.
Is it legal? Here’s the part that surprises people. Paying a ransom isn’t automatically illegal in the U.S. But the Treasury Department’s Office of Foreign Assets Control (OFAC) has warned that paying a group that’s on a U.S. sanctions list, or located in a sanctioned country, can violate federal law. That applies even if you had no idea who the attackers were, because OFAC treats these violations under strict liability. OFAC has also flagged that the people who help with a payment, like insurers and response firms, can be on the hook too. Some states also restrict ransom payments by government entities, and the rules keep changing.
The good news: OFAC has said that reporting the attack to law enforcement quickly and cooperating fully counts as a significant mitigating factor if a payment later turns out to have a sanctions problem. One more reason that call to the FBI should happen early.
This is exactly why you need professionals and a lawyer guiding the decision. Checking who the attackers are and whether payment is even allowed isn’t something to Google at 2 a.m. while a countdown timer ticks.
I’m not a lawyer, and this isn’t legal advice. If you’re facing this decision, talk to an attorney who handles cyber incidents.
The Best Time to Prepare Is Today
The businesses that come through ransomware in the best shape aren’t the lucky ones. They’re the ones who prepared before it happened. A few places to start:
- Back up your data and keep a copy offline or somewhere attackers can’t reach it, then actually test restoring from it
- Turn on multi-factor authentication for email, remote access, and anything with admin rights
- Keep software and devices updated, especially anything facing the internet
- Train your team to spot phishing, since that’s still one of the most common ways in
- Write down who you’d call: your IT or incident response contact, your insurance carrier, a cyber attorney, and your local FBI field office
- Review your cyber insurance or get a quote if you don’t have it
The Bottom Line
Ransomware is scary because it hits everything at once: your systems, your clients’ trust, your finances, and your peace of mind. But you don’t have to face it alone, and you don’t have to wait for the note on your screen to start preparing.
If you want to know where your business is most exposed before an attacker finds out for you, our Critical Services Security Assessment is a great place to start. And if you’d like a supportive group of women founders working through this stuff together, come join us in Security Besties.
We do want to make note that we are not an Incident Response Team for Ransomware. Ransomware negotiation is very specialized. We are able to help advise you on the right team for you and next steps.
Have questions? Reach out to us at info@pdrmconsulting.com. We’re here to help.
Sources
- OFAC advisory warns of civil penalties for ransomware payments (National Law Review)
- OFAC issues updated guidance on ransomware payments (Inside Privacy)
- Ransomware exclusions in 2026 cyber insurance (EFROS)
- FBI Internet Crime Complaint Center
