What exactly is ransomware, and is a 5-person small business really at risk?

We went through this two years ago at our 7-person wholesale food office in Toulouse. An employee opened a fake shipping tracking attachment sent to accounting, and within half an hour our entire server was encrypted. They demanded a 15.000 EUR ransom; we didn't pay, but since our network-connected backups were wiped out too, we had to re-enter 3 years of records from scratch.

Don't ever fall into the trap of thinking "I'll just pay the ransom and get my files back." Authorities and law enforcement in France strongly advise against paying. There are plenty of criminal gangs that take the money and never send the decryption key or send an incomplete one that leaves your system completely trashed.

Set aside a 100-150 EUR budget tomorrow and buy two external portable hard drives. Copy your accounting and customer database to one, unplug the cable as soon as it's done and lock it in the safe. No ransomware can encrypt a drive that isn't plugged into a computer.

They don't just lock files anymore; they use double extortion. They copy your files to their own servers before encrypting them. If you don't pay up, they threaten to leak your medical client records online and report you so you get hit with data protection fines.

thinking "we're a small business nobody cares about us" is super dangerous. attackers dont hand-pick companies automated scripts just hit every open ip address they find. if u get caught unprotected, company size doesnt matter.

As a business operating in France, if customer data is stolen, you may be legally required to report the breach to regulatory authorities and affected data subjects. Because of this, offline backups and system security are just as much a legal requirement as an operational one.

Does your standard antivirus only scan for known legacy signatures, or does it feature modern endpoint protection capabilities that heuristically block abnormal encryption activity in real time? Have you had your IT provider check what your license actually covers?

I'm curious too.

I agree with this. When making decisions write down the worst-case scenario too not just the best.

If you have questions write them; I'll answer as best I can.

Following.

Following. Processes without records never improve, because you don't know what to fix.

If I were you, I'd go this route.

There's a trap here, let me mention it. Security isn't absolute; it's about making attacks not worth the effort.

Taking measures without an inventory leaves doors you haven't seen open. Good luck with that.

I agree, and I'd like to emphasize that. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

If you have questions, write them; I'll answer as best I can.

We experienced almost the exact same thing last year. Everything goes well for the first three months; problems arise in the fourth.

When making decisions, write down the worst-case scenario too, not just the best. Hope this helps.

i'm a small business, let me expllain from my side and when we decide without measuring we always end up in the same place.

if you have questions, write them; Ill answer as best I can.

I went through the same thing two years ago. Trying to do this alone is the most expensive way.

If you post the result here, it will help others too.

This thread is archived.

Let me summarize what's been said so far. If you scold false alarms, nobody will report again.

Proven by experience.