Ransomware at a Small Business: Where the Money Actually Goes

Four costs larger than the ransom

Mention ransomware and most people think of the demand note. The demand is the number that makes the news. It is seldom where most of the money goes.

Time you cannot operate. While systems are locked, you are not scheduling, shipping, invoicing, or serving clients. At most businesses the value of those lost hours is far greater than the ransom.

Getting back to normal. Systems have to be rebuilt and data restored. Outside specialists have to be hired. Someone has to establish that the attacker no longer has access. All of it costs time and money. Sophos reported an average recovery cost of $1.53 million in 2025, a figure that excludes any ransom and is added to it.

Legal and regulatory consequences. Depending on the industry you are in and the data that was taken, a breach may bring notification duties, questions from regulators, and legal exposure that continue well after the systems are running.

Clients who leave. In high-trust and regulated fields such as accounting, legal, healthcare, and energy, clients do not forget which vendor lost their data. A portion of them will not return.

Why paying is a poor bet

Under pressure, the natural impulse is to pay and be done with it. The numbers argue against that. Sophos’s 2025 survey put the median ransom payment at $1 million. What that money buys is a decryption key supplied by a criminal, with no guarantee attached. Some files are returned corrupted, and some are never returned. A business that is known to have paid also becomes a more appealing target for the next attempt.

Most victims no longer pay. According to Verizon’s 2025 report, 64% of ransomware victims refused, because they had a better option available.

The way back is a backup you have tested

Businesses that recover quickly share one trait. They are able to restore from backups, and they know this because they have done it.

The testing is the part that counts. Until a restore has succeeded, the backup is a guess. We have come across “backups” that had not run for months, backups stored on the very network the ransomware encrypted, and backups that nobody on staff could restore under pressure. An incident is the wrong time to discover any of those.

This is where we would begin:

• Offline backups with tested restores. Keep at least one copy where ransomware on your network cannot get to it, and practice the restore.
• Prompt patching. For three years running, exploited vulnerabilities have been the single most common way in. Remove software that is no longer supported.
• MFA on everything. Most ransomware begins with a stolen password, and multi-factor authentication shuts that route. Do email, remote access, and admin accounts first.
• Managed endpoint detection. Put it on every device that connects to your systems, so that an intrusion is caught before it spreads.
• A written incident response plan. Include names and phone numbers, so nobody spends the first hour working out whom to call.
• Training for the staff who get targeted. The most common first move is still a phishing email, and employees who can recognize one are a real line of defense.

You do not need an enterprise budget for this list. You need someone who owns the controls and keeps them up to date. Our managed cybersecurity work is organized around exactly that: find what is exposed, secure what matters, and maintain it.

If you do not know where your gaps are, and in particular whether your backups would hold, begin there.

Find out what is exposed. Answer a few questions on backups, email, devices, and access, and you will get a plain picture of where you stand. It takes about three minutes.

→ Check your exposure · Book a consultation