In recent years, the ransomware threat has become one of the most serious IT risks facing companies. Ransomware is malicious code that encrypts files or locks systems and demands a ransom to restore access. Today, many criminal groups go even further: before encrypting, they copy the data and threaten to publish it, in a technique known as double extortion.
However, the ransomware threat is not just technical. It affects business continuity, finances, reputation and legal compliance. In this article, we explain how this type of attack works, what impact it has, how companies can protect themselves and what to do if they are attacked. We also show the role of document management platforms in prevention and recovery.
What is ransomware?
The term combines “ransom” with “software”. Put simply, it is a malicious program that blocks access to data until a sum is paid, usually in cryptocurrency. In most cases, attackers encrypt the files with strong algorithms, which makes recovery without the key practically impossible.
The most common entry points are phishing emails, stolen remote access credentials, unpatched vulnerabilities on internet-facing servers and software downloaded from untrustworthy sources. For this reason, prevention starts long before the attack, in the way the company manages identities, updates and access.
How a typical attack unfolds
| Phase | What happens |
|---|---|
| Entry | The attacker gains access through phishing, stolen credentials or a vulnerability |
| Lateral movement | Explores the network, looks for accounts with more privileges and locates the backups |
| Exfiltration | Copies sensitive data to use as additional leverage |
| Encryption | Encrypts files and systems, often out of hours |
| Extortion | Demands the ransom and threatens to publish the data |
This process can take days or weeks. For this reason, good monitoring makes it possible to detect the attack before the encryption phase.
The implications of the ransomware threat
Firstly, the most visible impact is the disruption of operations. Without access to documents, invoicing systems or operational platforms, many companies spend days or weeks operating at limited capacity. On top of this come the costs of investigation, recovery and strengthening security, which are usually high.
There are also legal consequences. When personal data is affected, the company may have to notify the data protection authority (the CNPD, in Portugal) within 72 hours and, in certain cases, inform the data subjects. Entities covered by the NIS 2 Directive also have obligations to report significant incidents. Finally, reputation suffers, especially when attackers publish customer or employee data.
Protection against ransomware
Since no single measure is enough, effective protection combines several layers:
- Updates: fix vulnerabilities quickly, especially on internet-facing systems.
- Multi-factor authentication: mandatory for remote access, email and administrator accounts.
- Least privilege: each user has only the access they need.
- Immutable backups: at least one copy isolated from the network, with regular restore tests.
- Endpoint protection: detection and response solutions, as well as blocking macros from unknown sources.
- Training: regular awareness training to recognise phishing.
- Monitoring: alerts for anomalous behaviour, such as mass file encryption.
The role of document management platforms
A well-configured SaaS document management platform reduces the exposure of documents. For example, files are no longer stored in shared folders on the local network, which are a frequent target. In addition, version control makes it possible to recover documents from before the attack, and activity logs help to establish what was accessed. Even so, it is advisable to check with the supplier how it makes backups, how often, and how quickly information can be restored.
Ransomware and third-party data
On contractor document management platforms, an attack can affect not only the company but also the workers of dozens of other companies. Fitness-for-work certificates, training certificates and identity documents are data that criminals can use for fraud or extortion. Data minimisation is therefore also a security measure: the less unnecessary data the company keeps, the smaller the impact of any leak.
Contracts with platform suppliers should likewise provide for immediate incident reporting, cooperation in the investigation and support in notifying the authorities. In this way, the company can meet legal deadlines even when the incident occurs in a third-party system. Finally, it is advisable to confirm periodically that the supplier tests data recovery and keeps isolated copies, and to ask for evidence of these tests.
What to do in the event of an attack
First, isolate the affected systems from the network, without switching them off immediately, to preserve evidence. Then activate the incident response plan and contact specialists. Next, assess the impact on personal data and meet the notification obligations. It is also advisable to report the incident to the competent authorities, such as, in Portugal, the CNCS and the Polícia Judiciária. Finally, restore from clean backups, but only after eliminating the cause of the attack.
The authorities advise against paying the ransom, because it does not guarantee data recovery, does not prevent the stolen information from being disclosed and funds new attacks.
Practical example: Recovery from immutable backups
Consider a services company that finds its file servers encrypted on a Monday morning. The operational documents were on a cloud document management platform, and the local servers had daily immutable backups. The team isolates the network, identifies the compromised account and restores the servers from Sunday’s backup. As a result, the company resumes activity within two days, without paying a ransom.
Ransomware protection checklist
- Inventory of critical systems and data.
- Multi-factor authentication on all remote access.
- 3-2-1-1-0 backups with restore tests.
- A tested incident response plan.
- Up-to-date emergency contacts.
- Regular staff training.
Preparing the organisation before an attack
The ability to respond depends heavily on what is done before the incident. The organisation should therefore have identified its critical systems and documents, know how long it can operate without each of them and have defined the order of recovery. In addition, the response plan should state who decides, who communicates with customers and authorities and where the emergency contacts are kept, including paper copies.
Likewise, simulation exercises make it possible to test the plan and correct flaws without the pressure of a real attack. For example, a tabletop exercise on ransomware quickly reveals whether the team knows how to restore backups and how long it takes. Thus, when an attack happens, decisions are faster and safer.
Common mistakes to avoid
A frequent mistake is to keep backups on the same network and with the same credentials as the main systems. In that case, the ransomware also encrypts the backups. Another mistake is never testing restores, only to discover at the worst moment that the backups are incomplete. Many companies also leave remote access without multi-factor authentication, one of the most exploited entry points.
Frequently asked questions
Are small businesses also targeted?
Yes. Many attacks are automated and look for any vulnerable system, regardless of the size of the company. In fact, small businesses are often easier targets, as they have fewer resources for protection.
Are files in the cloud protected?
They are better protected, but they are not immune to this type of attack. Synchronisation can spread encrypted files, so version control and backups remain essential.
How long does recovery take?
It depends on preparation. With tested immutable backups and a clear plan, many companies recover within a few days. Without that preparation, recovery can take weeks and, in some cases, part of the data is lost for good.
Does insurance cover ransomware attacks?
Some cyber insurance policies cover response and recovery costs. However, insurers increasingly require minimum measures, such as multi-factor authentication and isolated backups.
Conclusion: How to tackle the ransomware threat
The ransomware threat is persistent and constantly evolving. The best defence combines prevention, early detection and recovery capability. Updates, multi-factor authentication, immutable backups, training and a tested response plan significantly reduce both risk and impact.
In short, companies should treat ransomware as a business risk, not just an IT problem. With preparation, it is possible to recover without paying ransoms and to protect the trust of customers and partners.
Read also: Ransomware and backups: How to make sure recovery is really possible and How to prevent phishing attacks: Strategies and best practices.
For alerts and recommendations on cyber threats, see the National Cybersecurity Centre (CNCS).