A ransomware attack rarely begins with a dramatic warning. It may start with one convincing email, a reused password or a remote access account that has gone unnoticed. By the time staff cannot open files, access customer records or use core systems, every minute matters. A ransomware recovery plan for small businesses gives your people clear authority and practical actions when normal operations suddenly stop.

The aim is not simply to get files back. It is to protect customers, preserve evidence, meet regulatory responsibilities and restore the services that keep the business trading. For a professional practice, that could mean case management and email. For a logistics business, it may be dispatch, stock data and communications with drivers. The right plan reflects the systems your business cannot be without.

What a ransomware recovery plan for small businesses should achieve

A recovery plan is a business continuity document with a cyber incident at its centre. It sets out who makes decisions, how an attack is contained, where clean data can be recovered from and how staff, customers and relevant authorities will be kept informed.

This is different from having a backup product in place. Backups are essential, but they are only one part of recovery. If nobody knows who can authorise system shutdowns, how to contact IT support out of hours, or which application must be restored first, a good backup can still lead to a costly and disorganised response.

Your plan should work for a difficult Tuesday afternoon, not just for an annual compliance review. Keep it concise, store a printed copy away from the main network, and make sure key contacts can access it from a personal mobile phone if company email is unavailable.

Assign decision-makers before there is pressure

Small businesses do not need a large incident response department, but they do need named responsibilities. One senior person should be authorised to declare a cyber incident and make operational decisions. A technical lead, whether internal or outsourced, should coordinate containment and recovery. Another person should manage staff and customer communications.

Write down primary and deputy contacts, including personal telephone numbers where appropriate. Include your managed IT provider, cyber insurance contact, legal adviser and any critical software suppliers. If the managing director is away, the response cannot pause while the team waits for approval.

It is also sensible to define spending authority. Emergency specialist support, replacement devices or expedited software recovery can carry a cost. Agreeing a sensible limit in advance avoids avoidable delay while still keeping financial control.

Know what must be restored first

Recovery priorities should be based on business impact, not on which system is easiest to rebuild. Map the services required to keep operating over the first four hours, first day and first week. This should include data, applications, user accounts, internet connectivity, telephony and cloud services such as Microsoft 365.

For example, an accountancy firm may need secure access to client files and communications before it needs every historical archive. A manufacturer may need production scheduling and supplier contact details ahead of less critical internal reporting. Document workable manual alternatives too, such as paper order forms or a temporary telephone number. They will not replace your systems for long, but they can reduce immediate disruption.

Set realistic recovery targets. A recovery time objective defines how quickly a service needs to return. A recovery point objective defines how much data loss is acceptable, such as the previous hour or previous working day. Faster recovery and more frequent backups usually cost more, so these targets should reflect the actual commercial impact of downtime.

Make backup recovery a tested capability

Ransomware operators often target backups because they know they are the fastest route back into business. Keep at least one copy of essential data isolated from the main environment, using immutable cloud storage, an offline copy or another protected approach. The precise design depends on your systems, data volumes and recovery targets, but a backup that can be altered or deleted by a compromised administrator account is not enough on its own.

Protect backup administration with separate accounts, strong unique passwords and multi-factor authentication. Restrict who can delete data or change retention settings. Back up Microsoft 365 separately as well. Email and cloud files are business-critical, and standard platform retention features are not a substitute for a recovery plan tailored to your organisation.

Most importantly, test restores. Recover representative files, folders and whole systems into a safe environment, then check that the data opens correctly and the application works. Record how long it took and whether access permissions were preserved. A backup report showing ‘successful’ is reassuring, but it does not prove your business can recover.

What to do when ransomware is suspected

The first objective is to stop the attack spreading. Staff should know they are not expected to investigate it themselves. If they see ransom notes, unusual file extensions, repeated password prompts or files suddenly becoming inaccessible, they should report it immediately and stop using the affected device.

Your technical lead should isolate affected computers from the network and Wi-Fi as quickly as possible. Do not automatically wipe or rebuild devices before evidence has been assessed. Logs, ransom notes and system information may help establish how the attack happened, whether data was taken and what needs to be reported. Disconnecting a device is often appropriate; switching everything off without advice can remove useful evidence and create further uncertainty.

A practical first-response checklist should cover these distinct actions:

• isolate suspected devices and disable compromised accounts;
• contact your IT security support and cyber insurer promptly;
• preserve relevant evidence, including screenshots, alerts and timestamps;
• identify which systems, users and data may be affected; and
• move agreed communications onto safe devices and channels.

Avoid using potentially compromised email accounts to coordinate the response. Use personal mobile phones, a pre-agreed messaging channel or an unaffected system. Keep a written incident log of decisions, times, people involved and actions taken. This helps technical recovery, supports insurance claims and provides an accurate record should questions arise later.

Do not rush into paying a ransom. Payment offers no guarantee that data will be returned, that stolen information will be deleted or that systems are safe to use. It can also create legal, insurance and reputational complications. Seek specialist, legal and insurer advice before making decisions under pressure.

Assess reporting and communication duties

If personal data may have been accessed, stolen or made unavailable, assess whether the incident creates a risk to individuals’ rights and freedoms. UK data protection law can require notification to the Information Commissioner’s Office within 72 hours of becoming aware of a reportable breach. The requirement depends on the facts, so keep records of your assessment even where reporting is not required.

Clients and suppliers need calm, factual communication. Say what you know, what services are affected, what you are doing and when you will provide another update. Do not speculate about the attacker, the scale of data loss or recovery times. Early, honest communication is usually far better than customers discovering disruption without context.

Restore safely, not just quickly

Before restoring data, identify the likely entry point and remove the attacker’s access. That may mean resetting passwords, revoking active sessions, rebuilding compromised devices, patching vulnerable software and reviewing remote access settings. Restoring a server while a criminal still has valid credentials can lead to a second encryption event.

Recover the most important services in the agreed order, using a known-clean backup. Validate each service before reconnecting it to the wider environment. Check security monitoring, endpoint protection, user access and integrations, not only whether an application appears to start.

Some businesses can operate temporarily with a smaller set of services, while others need full restoration before they can trade safely. That is why recovery should be led by business priorities alongside technical advice. A hands-on IT partner can provide the technical coordination, but leadership still needs to decide what acceptable temporary operation looks like for customers and staff.

Test the plan before you need it

A recovery plan becomes useful when people have practised it. Run a tabletop exercise at least annually and after significant changes, such as a new cloud platform, office move, acquisition or change in key suppliers. Start with a believable scenario: a member of staff reports encrypted shared files at 10.15am, and the finance system is unavailable.

Talk through who receives the call, who can isolate systems, how leadership is contacted, where recovery credentials are held and what staff are told. Include remote workers. They may be using home networks, personal mobile devices or local copies of files, all of which affect containment and communication.

Follow exercises with improvements, not blame. If contact details are out of date, recovery credentials are inaccessible or a priority system has no tested backup, fix it and record the change. Targeted ransomware and phishing awareness training matters here too. Technology can reduce the chance of an attack succeeding, but staff who recognise suspicious activity can shorten the incident dramatically.

The most reassuring recovery plan is one your team can use without becoming cybersecurity specialists. Put clear decisions, protected backups and real human support around the systems that matter most, and an already stressful event becomes one less thing your business has to face alone.

A finance manager receives an email from the managing director asking for an urgent supplier payment. The wording is familiar, the signature looks right and the request arrives just before close of business. One detail has changed: the sender’s account has been compromised, or the address differs by a single character.

Knowing how to prevent business email compromise means preparing for this exact moment. Business email compromise, often shortened to BEC, is not always a technical attack that triggers an obvious warning. It is a confidence trick aimed at people, processes and the everyday pressure to act quickly. For a UK business, the consequences can include misdirected payments, payroll fraud, exposed client data, disrupted operations and difficult conversations with customers or regulators.

The most effective protection combines sensible technology with clear financial controls and staff who know they are allowed to pause and check. That approach gives leaders one less thing to worry about without expecting every employee to become a cybersecurity specialist.

What business email compromise looks like

BEC attacks exploit trusted relationships. Criminals may impersonate a director, supplier, solicitor, customer or colleague. In more serious cases, they gain access to a genuine mailbox using stolen credentials and read email conversations before sending a convincing request at the right time.

A common example is invoice fraud. The attacker monitors correspondence with a supplier, then sends amended bank details shortly before an expected payment. Other attacks target payroll teams with requests to change an employee’s bank account, or persuade staff to buy gift cards and send the codes. Professional services firms may be targeted for client funds or sensitive documents, while logistics businesses can be pressured by time-sensitive delivery and supplier requests.

The message may not contain malware or an obviously malicious link. That is why spam filtering alone cannot solve the problem. If the request appears to come from a genuine account, the decision-making process around it becomes the final line of defence.

How to prevent business email compromise with layered controls

No single product or policy prevents every BEC attempt. The practical answer is to create layers that make impersonation harder, restrict an attacker’s access and stop a single email from authorising a financial or data-sensitive action.

Make payment verification independent of email

Your payment process should assume that bank detail changes and unusual payment requests could be fraudulent, even when they arrive from a familiar contact. Do not verify a change by replying to the same email thread or using a telephone number supplied in the message. Instead, call a known contact using a number held in your records or on the supplier’s established website.

For significant payments, require a second person to approve the transaction. This should be a meaningful check, not a quick confirmation between two people who are both working from the same suspicious email. Set clear thresholds for dual approval and ensure cover arrangements apply during holidays, busy periods and absences.

It can feel slower than approving an urgent request immediately. However, a short verification call is considerably less disruptive than trying to recover a payment once funds have left the account. The right level of control depends on your payment volumes and operational needs, but no organisation should allow bank detail changes to be approved by email alone.

Protect Microsoft 365 accounts properly

A compromised Microsoft 365 account gives a criminal valuable context: names, invoices, meeting arrangements and writing styles. Strong, unique passwords remain essential, but they are not enough on their own.

Multi-factor authentication should be enabled for all users, with particular attention to directors, finance teams, administrators and anyone with access to sensitive client data. Where possible, use phishing-resistant methods such as authenticator app number matching or security keys rather than relying solely on text messages. Text-message codes are better than no second factor, but they can be vulnerable to social engineering and number takeover attacks.

Also review who has administrator privileges. Staff should only have the access needed for their role, and dormant accounts should be removed promptly. Conditional access rules can add another useful layer by challenging unexpected sign-ins, blocking high-risk access and reducing exposure from unmanaged devices. These controls need careful configuration, especially for organisations with travelling or remote-working staff, so security does not become a barrier to legitimate work.

Secure your email domain and watch for lookalikes

Email authentication helps receiving systems assess whether a message genuinely came from your domain. SPF, DKIM and DMARC work together to reduce the chance that criminals can spoof your business name and send convincing messages to customers or colleagues.

Configuration matters. An incomplete or overly permissive setup can give a false sense of security, while a strict policy applied without preparation may affect legitimate messages sent by third-party systems. Start by identifying every approved sender, monitor the results, then move towards a policy that rejects unauthorised use of your domain.

It is also worth registering alerts for domains that closely resemble your business name. Criminals often use small substitutions that staff may miss at a glance, particularly on mobile devices. Good email protection can flag suspicious display names, unusual sender patterns and impersonation attempts before they reach the inbox.

Check for the quiet signs of account takeover

When a mailbox is compromised, attackers often create inbox rules to hide replies, forward messages externally or move warnings into deleted folders. These rules can give them time to continue a conversation unnoticed.

Your IT team or managed provider should monitor for unusual sign-ins, impossible travel, unexpected forwarding rules and changes to authentication settings. Regularly review mailbox delegation and shared mailbox permissions too. A former employee, an unnecessary external forward or an overlooked administrator account can become an avoidable route into the business.

Endpoint protection and secure web browsing controls are part of this picture. Credential theft often begins when someone enters their details on a convincing fake Microsoft 365 sign-in page. Blocking known malicious sites and detecting suspicious activity on devices reduces the chance that a stolen password becomes a compromised mailbox.

Give staff a simple, repeatable response

Awareness training is most useful when it reflects the decisions people actually make at work. A generic annual presentation will not prepare someone to challenge an email that appears to come from their managing director at 4.45pm on a Friday.

Teach staff to slow down when a request involves money, bank details, passwords, sensitive files, gift cards or a change in normal process. Urgency, secrecy and authority are common pressure tactics. A request such as “I need this dealt with privately” should prompt verification, not compliance.

Employees should feel confident reporting a suspicious email without worrying that they are wasting IT’s time. Make reporting easy through a clear button, mailbox or helpdesk route, and explain what happens next. Quick reporting can protect more than one person: an email sent to a single finance colleague may have reached several others.

Targeted phishing simulations can help teams practise safely, provided they are used constructively. The aim is to improve recognition and reporting, not to embarrass people. Look for patterns in results, such as recurring supplier impersonation attempts or users struggling with credential prompts, then tailor training to the risk.

Prepare for the moment something gets through

Even well-managed organisations can face a convincing attack. A short, tested incident process prevents confusion when time matters.

If someone suspects they have responded to a fraudulent request, changed bank details or entered credentials into a suspicious site, they should report it immediately. The priority is to contain the issue: reset credentials, revoke active sessions, check mailbox rules, review account activity and block malicious senders or domains. If a payment has been made, contact the bank without delay and provide the details required for its fraud response process.

Preserve the suspicious email and relevant records rather than deleting everything straight away. Your IT support team will need headers, timestamps, affected accounts and details of what was shared or approved. Where personal data may be involved, assess your reporting responsibilities promptly. Regulated organisations should ensure their incident process aligns with their wider compliance and data protection obligations.

Put ownership behind the controls

Business email compromise prevention is often weakened by unclear ownership. Finance may own payment approvals, IT may manage email security and HR may oversee payroll changes, but the gaps between those responsibilities are where attackers succeed.

Assign named owners for payment controls, Microsoft 365 security, supplier verification and staff awareness. Review the arrangement after a near miss, a supplier change or a significant change in how people work. For many small and medium-sized businesses, outsourced monitoring and practical support can be the sensible option, particularly where there is no internal IT team available to investigate suspicious account activity.

The goal is not to make every transaction difficult. It is to make high-risk requests deliberately harder to complete without an independent check. When staff have clear rules, reliable technology and responsive human support behind them, they can protect the business while getting on with the work that keeps it moving.

April 2022

Is your Business at Risk of Nation-State Trouble ?

Today’s nation-state cybercriminals are going a beyond traditional espionage, expanding their scope of work to include disabling infrastructure, disrupting supply chains, industrial sabotage, misinformation and extortion – and 90% of them regularly attack businesses in the private sector, like companies that provide goods and services or financial institutions.  

Nation-State Danger is Escalating 

Nation-state cyber threats are something that businesses in every sector will have to be prepared to deal with long term. As the world becomes increasingly interconnected and cloud-driven, cybercriminals will have more reason and more opportunity to strike targets that fall well outside their prior theatres of operation. The bad guys are getting better at pulling off successful operations as well. Russian nation-state actors are increasingly effective, jumping from a 21% successful compromise rate in 2020 to a 32% rate in 2021 – and every increase in that percentage is a loss for public and private sector businesses around the world.

Experts around the world have asserted for years that modern wars will carry a heavy component of cyberattack and hacking activity, and they were right. Nation-state threat actors are targeting infrastructure components using malware and ransomware in the Russia/Ukraine conflict. CISA cautions that attacks and damage from the cyberwar component of this conflict may spread beyond Ukraine, saying in an advisory: “Russia’s unprovoked attack on Ukraine, which has involved cyber-attacks on Ukrainian government and critical infrastructure organisations, may impact businesses both within and beyond the region.” 

The NCSC (National Cyber Security Centre) released a number of advisory recently warning UK businesses of cyberattack danger presented by nation-state threat actors in light of the current Russia-Ukraine conflict. Newspapers in the UK reported similar warnings. Russia is the force behind 58% of nation-state attacks.  

Common Nation-State Cybercrime Terms

Microsoft defines nation-state cybercrime as malicious cyberattacks that originate from a particular country to further that country’s interests. It’s a complex subject that is full of twists and turns, and just like any other field, it also has some very specific terminology. 

Nation-State Threat Actor – Nation-state threat actors are people or groups who use their technology skills to facilitate hacking, sabotage, theft, misinformation and other operations on behalf of a country. They may be part of an official state apparatus, members of a cybercrime outfit that are aligned with or contracted by a government or freelancers hired for a specific nationalist operation. 

Advanced Persistent Threat (APT) – These are nationalist cybercrime outfits with sophisticated levels of expertise and significant resources that work to achieve the goals of the government that supports them, undertaking defined operations with specific goals that forward the objectives of their country.   

Infrastructure Attack – When nation-state actors conduct an infrastructure attack, they’re attempting to damage one of their country’s adversaries by disrupting critical services like power, water, transportation, internet access, medical care and other essential requirements for daily life. Infrastructure attacks are a major component of modern spycraft and warfare.  

Common Tactics Used by Nation-State Groups 

Nation-state threat actors will use a wide variety of means to accomplish their goals, but these are some of their go-to attacks to use against both public and private sector targets. There was a 100% rise in significant nation-state incidents between 2017-2021. 

Phishing Attack – A technique for attempting to persuade the victim to take an action that gives the cybercriminal something that they want, like a password or accomplishes the cybercriminal’s objective, like infesting a system with ransomware through a fraudulent solicitation in email or on a web site. 

Distributed Denial of Service (DDoS) Attack – Distributed Denial of Service attacks are used to render technology-dependent resources unavailable by flooding their servers or systems with an unmanageable amount of web traffic. This type of attack may be used against a wide variety of targets like banks, communications networks, media outlets or any other businesses that rely on network resources.  

Malware Attack – Malware is a toolbox of “malicious software.” It is commonly used as a catch-all term for any type of malicious software designed to harm or exploit any programmable device, service or network. Malware includes trojans, payment skimmers, viruses and worms. 

Ransomware Attack– Ransomware is the favoured tool of nation-state cybercriminals. This flexible form of malware is designed to encrypt files, lock up devices and steal data. Ransomware can be used to disrupt production lines, steal data, facilitate extortion commit sabotage and a variety of other nefarious purposes. Ransomware attacks are highly effective and can be used against any businesses.   

Backdoor Attack – Nation-state threat actors will often intrude into an businesses systems and establish a foothold called a back door that allows them to return easily in the future. It could be months or years before they use it. This also affords them the opportunity to unobtrusively monitor communications, copy data and find vulnerabilities that enable further attacks. 

How Can You Protect Your Company from Nation-State Trouble?  

These tips can help businesses steer clear of a nation-state cyberattack. 

• Bolster security awareness training. When employees know what to look for, the companies that employ them have 70% fewer security incidents.   
• Invest in strong email security. The most likely way for your company to encounter nation-state threats is through a phishing email. 
• Teach employees to spot and stop phishing. Malicious messages can carry ransomware (the top weapon of nation-state cybercriminals) and training improves phishing awareness by 40%. 
• Patch and update all software and hardware. Nation-state threat actors love to capitalize on vulnerabilities and are experts at leveraging zero-day exploits. 
• Adopt a zero-trust security model – Add two-factor authentication to all accounts to secure employee credentials, the cornerstone of zero-trust security, and reduce password-based intrusions by 99% 
• Be on guard for credential compromise – An estimated 60% of passwords that appear in more than one breach are recycled or reused, and therefore easily obtained by APTs from the dark web. 

We Can Help #MSnetUK

Here are a few straightforward tips to help reduce your cybersecurity risk, whether you’re online or offline.

1. Always be wary of any unexpected contact. If your bank, or any organisation you have dealings with, gets in touch out of the blue, treat it with caution. If you receive any emails that ask you to confirm personal information, assume it is a scam. Don’t click on any links and don’t provide any of your personal details. Instead, call the company that the communication claims to be from using a recognised telephone number and make sure that you’re dealing directly with them before sharing any of your details or responding to any requests.

2. Safeguard yourself against identity theft by making sure you never give out personal information to an unrecognised party. This can be used to steal your identity and access your accounts, so keep it safe. Don’t confirm any details to cold callers, even if they’re just asking you to verify information they claim to already have on file, and avoid entering your details into any promotional emails.

3. Keep operating systems and virus protection software up-to-date. Don’t ignore software updates on your mobile phone, computer and other devices, as these can often include measures to protect against new kinds of scams, viruses and ransomware.

4. Make sure all your accounts have a strong password using a mixture of letters (lower and upper case), numbers and symbols. Don’t use the same password for multiple accounts and try and get into the habit of changing them regularly as this helps to reduce the risk of a cyber security attack. Ideally use a Password manager, or Complex Passphrase’s instead.

5. Be careful when using public WiFi. Use safe and secure WiFi connections and avoid public WiFi when you can. Your standard 3G or 4G connection will usually be a lot more secure than the one in the coffee shop or restaurant.

By following these simple cybersecurity steps you’ll be going a long way to helping keep your information safe online. An important rule to live by is that prevention is usually better than the cure! So, if you’re unsure about a potential risk, it’s better to proceed with caution rather than potentially put yourself in a compromising position.

Avoid becoming a victim of the next ransomware attack — protect yourself with a Business Continuity plan. Get in touch today to find out how our reliable solutions can help. #ransomware #cybersecurity #MSnetUK