What ransomware is and why it puts your company's data at risk

Ransomware is a type of malicious software that encrypts the files on a victim's computer or network, blocking access to the data until a ransom is paid. It is one of the costliest forms of cyberattack for small and medium-sized businesses — and Romania is no exception.

How a ransomware attack works

The attack unfolds in a few fast stages:

1. Infection — most often through an email with a malicious attachment, a phishing link or a vulnerability in outdated software.
2. Spread — once on the network, the ransomware looks for every reachable drive: computers, NAS devices, shared folders, even connected backups.
3. Encryption — files are encrypted with a key only the attacker holds. Documents, databases, accounting archives — everything becomes inaccessible within hours.
4. The ransom demand — a message appears asking for payment in cryptocurrency, usually between a few hundred and tens of thousands of euros.

Why SMEs are frequent targets

Large corporations have dedicated IT security teams and substantial protection budgets. SMEs, on the other hand, are often seen as easier targets:

• Outdated software on office computers
• Staff without training in spotting phishing emails
• No isolated, tested backup system
• Limited time to recover — every day of downtime costs real money

In Romania, accounting firms, medical clinics and law firms are among the most targeted, because they hold sensitive data and work under the pressure of legal deadlines.

The myth of cloud and external drive backups

A backup stored on a drive permanently connected to the computer (USB hard drive, network-mounted NAS, synced OneDrive) doesn't protect you from ransomware. Modern ransomware looks for and encrypts every reachable drive, including those synced to the cloud.

A valid backup has to be:

• Isolated — not permanently reachable from the current network
• Versioned — containing historical versions, not just the latest copy
• Tested — restores must be checked regularly, not assumed

What you can actually do

Effective protection against ransomware is based on the 3-2-1 rule: 3 copies of your data, on 2 different types of media, 1 of them offsite (away from the office).

In practice, that means:

• A local NAS with immutable snapshots (which ransomware can't overwrite)
• An encrypted cloud backup (Wasabi, Backblaze B2) — separate from the local network
• Monthly restore testing — having a backup isn't enough, you need to know it works