Motta Industries Blog

For many small businesses, the website is no longer a brochure. It takes bookings, processes orders, collects leads, hosts customer accounts and connects to email, payments and inventory. When it stops working, so does a large part of the business. That is exactly what ransomware is designed to exploit.

Ransomware is malicious software that locks up files and systems, usually by encrypting them, and then demands payment to restore access. Increasingly, attackers also steal data first and threaten to publish it. Small businesses are not too small to be targets. They are often seen as easier ones to reach.

This guide explains what ransomware means for a business that depends on its website, how to prepare before anything happens and what to do in the first hours of an incident.

Why ransomware matters to small businesses

The scale of the problem is easy to underestimate because so many incidents go unreported. The FBI’s 2023 Internet Crime Report, published in spring 2024, recorded 2,825 complaints identified as ransomware with adjusted losses of more than $59.6 million, an increase of 18 percent in complaints and 74 percent in reported losses compared with 2022. The report notes that these figures are conservative. When the FBI infiltrated one ransomware group’s infrastructure, it found that only about 20 percent of that group’s victims had reported to law enforcement.

The report also explains that ransomware infections impact individual users and businesses regardless of size or industry, causing service disruptions, financial loss and, in some cases, permanent loss of valuable data. The reported loss figures do not include lost business, time or wages, which are often the largest costs for a small company.

For a business that runs on its website, the damage can spread quickly:

• Lost sales. An online store or booking system that is offline cannot take orders.
• Locked data. Customer records, order histories and content may be encrypted.
• Exposed information. Stolen customer data can create notification duties and lasting reputational harm.
• Broken connections. Email, payment, shipping and accounting tools connected to the site may be affected.
• Recovery costs. Rebuilding systems, hiring help and handling customer communication all take time and money.

How attackers get in

Ransomware rarely arrives out of nowhere. It usually follows a weakness that could have been closed. The most common entry points for small businesses include:

• Stolen or weak passwords, especially on email, hosting control panels and website administrator accounts.
• Phishing emails that trick staff into opening attachments, clicking links or entering login details on fake pages.
• Unpatched software, including outdated content management systems, plugins, themes and server software.
• Exposed remote access services left open to the internet without strong protection.
• Compromised vendors or shared accounts that give attackers a path into your systems.

The joint #StopRansomware Guide, published in October 2023 by CISA, the FBI, the NSA and MS-ISAC, organizes its advice around these initial access vectors. It recommends prioritizing timely patching of internet-facing servers, especially for known exploited vulnerabilities, and implementing phishing-resistant multifactor authentication for all services, particularly email, VPNs and accounts that access critical systems. The authoring agencies also acknowledge the difficulty small and medium businesses have keeping internet-facing servers updated, and urge moving some systems to reputable managed providers to reduce, not eliminate, maintenance burdens.

Start with leadership, not technology

Preparation begins with a decision by the owner or manager that ransomware is a business risk, not just an IT problem.

CISA’s Cyber Essentials Starter Kit, released in spring 2021, makes this point directly. It states that being a cyber leader does not require technical expertise, but rather an ability to change the culture of your organization. It encourages leaders to approach cyber risk as they would any other hazard and to plan for and conduct drills for cyberattacks as they would a fire, making the response an extension of other business contingency plans.

In practice, leadership means:

• Naming one person responsible for cybersecurity, even if that person relies on outside help.
• Knowing which systems the business cannot operate without.
• Setting aside time and budget for backups, updates and training.
• Making sure everyone understands that reporting a mistake quickly is always better than hiding it.

Build backups that survive an attack

Backups are the single most important defense against ransomware, but only if they work when you need them.

The #StopRansomware Guide recommends maintaining offline, encrypted backups of critical data and regularly testing their availability and integrity in a disaster recovery scenario. It warns that most ransomware actors attempt to find and subsequently delete or encrypt accessible backups, and that automated cloud backups may not be sufficient on their own because encrypted local files can sync to the cloud and overwrite good copies.

The Cyber Essentials kit offers the same advice in simpler terms: employ a backup solution that automatically and continuously backs up critical data and system configurations, and protect backups with physical security, encryption and offline copies.

For a website, a strong backup plan covers:

1. Website files, including themes, plugins, uploads and custom code.
2. Databases that hold content, orders, accounts and settings.
3. Configuration, such as server settings, domain records and integration keys stored securely.
4. Connected systems, like email, customer records and accounting data.

Keep at least one copy that is offline or cannot be changed by the same accounts that manage the live site. Store backups in a location separate from your hosting account. Most importantly, test a full restore on a schedule. A backup that has never been restored is a hope, not a plan.

Reliable web hosting with independent, versioned backups makes this much easier, but it is still worth keeping your own copy.

Reduce the ways in

Prevention will never be perfect, but small steps close the most common doors.

Turn on multifactor authentication everywhere. Start with email, hosting, domain registrar and website administrator accounts. Phishing-resistant methods such as security keys are strongest for administrators.

Update consistently. Apply security updates to your content management system, plugins, themes and server software promptly. Remove plugins and themes you no longer use. Replace software that no longer receives updates.

Limit administrator access. Give each person their own account with only the permissions they need. Remove accounts when people leave.

Train staff to spot phishing. Show real examples, explain how to check a sender and make reporting quick and easy for everyone.

Review vendors and integrations. Know which outside services connect to your site and what access they hold.

Ongoing website maintenance is where many of these tasks naturally live: updates, backups, security checks and account reviews on a regular schedule.

Questions to ask your hosting provider

Your host and developer play a large part in recovery, so ask them before anything goes wrong:

• How often are backups taken, and how long are they kept?
• Are backups stored separately from the live server and protected from deletion?
• How quickly can a full restore be completed, and has one been tested recently?
• Who do we call after hours, and what is the expected response time?
• What logs are kept, and for how long?

Clear answers tell you whether your current setup matches how much downtime the business can tolerate.

Write a simple incident response plan

When an attack happens, stress is high and time matters. A short written plan prevents confusion.

The #StopRansomware Guide recommends creating, maintaining and regularly exercising a basic cyber incident response plan and associated communications plan, and keeping a hard copy and an offline version available. That last detail is important: if your systems are encrypted, a plan stored only on those systems is useless.

A small business plan can fit on two pages and should include:

• Contacts. Your hosting provider, developer, IT support, insurer, bank and legal advisor, with phone numbers.
• First steps. How to isolate affected devices and accounts without destroying evidence.
• Decision makers. Who can authorize shutting down the site, contacting customers or bringing in outside help.
• Communication. Templates for informing staff, customers and partners.
• Recovery. Where backups are stored and how to restore them.
• Reporting. How and where to report the incident.

Review the plan once a year and walk through a short scenario with the people involved, updating contacts and steps as anything changes.

What to do if ransomware strikes

If you discover ransomware, follow your plan and act quickly:

1. Isolate affected systems. Disconnect infected devices from the network and change compromised passwords from a clean device.
2. Call for help. Contact your hosting provider, developer or IT support and, if you have it, your cyber insurer.
3. Preserve evidence. Avoid wiping systems until you understand what happened.
4. Report it. In the United States, the FBI urges victims to report ransomware incidents to the IC3, regardless of whether they decided to pay. Reporting may help investigators provide information on decryption or recover payments.
5. Restore from clean backups. Rebuild on patched systems and change all credentials before going live again.
6. Communicate honestly. Tell customers what happened, what you are doing and what they should do, consistent with any legal obligations.

On the question of payment, the agencies are clear. The #StopRansomware Guide states that the authoring organizations do not recommend paying ransom, because payment will not ensure your data is decrypted, that your systems will no longer be compromised or that your data will not be leaked. Seek professional and legal advice before making any decision.

A fictional example

Consider a fictional bicycle shop that sells parts online and takes service bookings through its website. An employee opened an invoice attachment that looked real, and attackers used the foothold to encrypt the office computers and the website’s hosting account.

Because the shop had prepared, the damage was limited. The owner found the printed response plan in the office drawer and called the hosting provider and developer. The developer took the site offline, rebuilt it on a clean server and restored files and the database from an offline backup made the night before. Customers saw a short maintenance notice and received an email explaining the outage. The shop reported the incident, reset every password and added multifactor authentication to the accounts that had lacked it. The store was taking orders again within two days.

A ransomware readiness checklist

• One person is responsible for cybersecurity.
• Critical systems and data are listed.
• Backups cover files, databases and configuration.
• At least one backup is offline or immutable.
• Restores are tested on a schedule.
• Multifactor authentication is enabled on all key accounts.
• Software is updated promptly and unused plugins removed.
• Staff are trained to recognize phishing.
• A short incident response plan exists in printed form.
• Contacts for hosting, development, insurance and reporting are listed.

Ransomware readiness is not about expensive tools. It is about knowing what you depend on, keeping copies you can trust and having a plan before you need one. For a broader review of your protections, explore our trust and security practices.