Ransomware

What it means

Ransomware is malicious software that encrypts data on a company’s computers and servers, after which the attackers demand a ransom, usually in cryptocurrency, to unlock it. Modern attacks also steal the data before encrypting it and threaten to publish it if the company does not pay.

An attack most often starts with a phishing email, a stolen remote access password or unpatched software. The attacker then often moves quietly through the network for days or weeks, looking for backups and sensitive data, and only then starts the encryption.

For a company an attack means operations halting, lost data and recovery costs. If personal data are stolen, the incident must also be reported under GDPR and, for entities within the scope of NIS2, under the cybersecurity rules.

How it works in practice

The most important defence is backups that an attacker cannot delete or encrypt, meaning offline or immutable ones, together with regularly tested restores. Without them a company faces a choice between paying and losing its data.

Further measures are two-factor login, regular updates, restricted administrator rights and access on the zero trust principle. As an accounting firm, we naturally keep client data in several separate backups.

The response to an attack should be part of the business continuity plan: who decides, whom to contact, how to disconnect devices and how to restore critical systems. Cyber insurance can cover specialist costs and lost income.

What to watch out for

Paying the ransom does not guarantee that the company will get its data back or that they will not be published. It also funds further attacks and in some cases may breach sanctions rules. The decision should be made with specialists and with an understanding of the legal risks.

After an attack, restoring data is not enough. The way the attacker got in must be found and closed, or the attack may happen again. After a restore we check accounting data for completeness and fill in what was lost between the last backup and the attack.