Small business ransomware protection in the age of AI ransomware

What is ransomware, and what is "AI ransomware"?

Ransomware is malicious software that scrambles (encrypts) the files on your computers or servers so you can't open them, then demands a payment for the key. Many groups now also steal a copy of your data first and threaten to publish it, a tactic called double extortion. "AI ransomware" isn't one specific program. It describes how attackers use AI to write more convincing phishing lures, scan for unpatched systems faster, and target more businesses with less effort.

Small businesses are attractive because they often have valuable data, like client records, payment info and invoices, but no IT department. The FBI and CISA run the joint StopRansomware effort with free guidance, a sign of how common these attacks have become.

How ransomware gets into small businesses

• Phishing emails with a malicious link or attachment. See our AI phishing protection guide.
• Stolen or reused passwords, especially on email and remote-access tools without multi-factor authentication.
• Unpatched software: old versions of Windows, routers, website plugins or point-of-sale systems.
• Remote access left open to the internet, such as remote desktop with a weak password.
• A compromised vendor or IT provider who has access to your systems.

Warning signs of a ransomware attack

• Files suddenly renamed with strange extensions, or that won't open.
• A ransom note on the screen or in your folders.
• Computers running unusually slowly, or security tools switched off without explanation.
• New administrator accounts or logins at odd hours.

Ransomware protection checklist for small businesses

1. Back up with the 3-2-1 rule: three copies of your data, in two different places, with one offline or in the cloud where ransomware can't reach it. Test a restore every few months.
2. Turn on automatic updates for computers, phones, routers, and your booking, POS and website software.
3. Use multi-factor authentication on email, cloud storage, banking and any remote access.
4. Close what you don't use. Turn off remote desktop if nobody needs it, and remove old accounts for staff who have left.
5. Limit admin rights. Day-to-day work should happen on accounts that can't install software.
6. Use reputable security software on every computer, and keep it on.
7. Train everyone to pause on unexpected attachments and urgent links.
8. Write a one-page incident plan: who to call (IT help, your bank, your insurer), where backups live, and how you'll keep taking bookings if computers are down.

What to do if ransomware hits

1. Disconnect affected devices from Wi-Fi and the network, but don't wipe them. Evidence matters for recovery and claims.
2. Call your insurer's claims or breach hotline first if you have cyber insurance. Many policies provide access to response experts and expect to be told before you hire vendors or talk to the attackers.
3. Report it to the FBI at ic3.gov and through CISA's StopRansomware resources.
4. Don't rush to pay. The FBI discourages paying ransoms, and payment doesn't guarantee you get your files back or that stolen data is deleted.
5. Restore from clean backups once the systems are cleaned, and change passwords.
6. Check your notification duties. If customer data was exposed, state laws may require you to notify people.

How cyber insurance may help with ransomware

Depending on the policy, cyber insurance can help pay for incident response experts, data and system restoration, business interruption and lost income, customer notification, legal defense, and in some cases extortion payments where legal. Coverage, limits and exclusions vary by carrier, and insurers commonly ask about backups and MFA on the application. Learn more about cyber insurance for AI scams. AI Shield Coverage doesn't sell insurance; we point you to licensed insurers' own quote pages.

Backups and MFA are both on our free AI Scam Readiness Checklist. Start there.