You arrive at the office on Monday morning, switch on the computer and cannot open a single document. Instead of your files there is a message: “Your data has been encrypted. Pay within 72 hours”. This is the typical scenario of a ransomware attack on a professional office, and it is one of the most feared because it brings work to an abrupt halt.
What is ransomware?
Ransomware is a type of malicious software that makes a victim’s files or systems unusable, usually by encrypting them, and demands a ransom to make them accessible again. Payment is almost always requested in cryptocurrency.
In recent years double extortion has become widespread: before encrypting the files, criminals copy them. So even if the victim has a backup, the threat becomes: “Pay, or we publish your clients’ data”.
How does ransomware get into an office?
The most common ways in are few and well known:
- Phishing emails with an attachment or a link that installs the program (see how to spot phishing).
- Stolen or weak passwords, especially when used without two-factor authentication.
- Exposed remote access: remote control programs or ports opened on the router to work from home.
- Out-of-date software with known vulnerabilities: in the DBIR 2025, exploitation of vulnerabilities is the entry point in 20% of breaches.
- Compromised suppliers: according to the same report, third-party involvement has doubled, reaching 30% of breaches.
Once inside, the attacker often does not act straight away: they explore the network, look for the backups to delete them, and copy the data. Days can go by. It is in this window that noticing unusual behaviour makes the difference.
Why are professional offices a target?
- They hold confidential data (contracts, legal cases, financial statements, tax returns, projects) that is very valuable to the client, and therefore to a blackmailer too.
- They work to deadlines: a few days of downtime during a tax or court deadline is enormously damaging, and the criminal knows it.
- They often have few defences: no in-house technician, the internet provider’s router, backups on a drive that is always connected.
The figures confirm it. According to the Verizon Data Breach Investigations Report 2025, ransomware is present in 44% of the breaches analysed, but in 88% of those that hit small and medium-sized organisations, compared with 39% for large ones.
Is it worth paying the ransom?
The authorities’ answer is clear: no. And not just on principle.
- There is no guarantee you will get your files back, or that the key will work on all of them.
- There is no guarantee that the stolen data will be deleted.
- Those who pay become a known target and may be attacked again.
- You are funding the criminal organisation.
More and more victims are choosing not to pay: according to the DBIR 2025, 64% did not pay the ransom (up from 50% two years earlier) and the median ransom paid fell to 115,000 dollars. Choosing not to pay, however, is only sustainable if there is a backup to restart from.
The 6 defences that really work
- A disconnected, encrypted and tested backup. At least one copy must be out of reach of the office network (disconnected or immutable), and restoring from it must be tested periodically. This is exactly what CISA’s #StopRansomware guide recommends. → The 3-2-1 backup rule
- Two-factor authentication on email, cloud services and remote access. → Passwords, MFA and passkeys
- Automatic updates for the operating system, software, router and NAS.
- Remote access only via VPN, never through open ports or remote control programs that are always running. → VPNs and remote working
- A firewall that closes what is not needed and watches the traffic: a PC contacting a malicious server or sending large amounts of data outside is a warning sign not to be ignored. → Why the router is not enough
- People trained to recognise scams and to report a wrong click immediately.
What to do if ransomware has already struck
In short: isolate, do not pay on impulse, call your technician, assess your obligations.
- Disconnect the affected computers from the network (cable and Wi-Fi), without switching them off.
- Do not delete anything, and take a photo of the ransom message.
- Call your technician and, if you have one, your cyber insurer.
- Check the backups before any restore: they must be intact and not infected.
- Report it to the Postal Police (Polizia Postale, Italy’s cybercrime police).
- If personal data is involved, consider notifying the Italian Data Protection Authority (Garante per la protezione dei dati personali) within 72 hours (see GDPR and data breaches).
The full procedure is in the guide cyberattack: what to do straight away.
How Strega Defence helps against ransomware
No product can promise to stop every attack. What can be done is to reduce the ways in and notice early. Strega Defence closes by default whatever is not needed, blocks connections to addresses known to be malicious and alerts the owner on their phone, in plain language, when it notices something that matters. If a device behaves suspiciously, it isolates it from the rest of the network on its own until the technician checks it. Discover Strega Defence.
Frequently asked questions
Can ransomware be removed with an antivirus?
An antivirus can remove the malicious program, but it cannot give you back files that have already been encrypted. To recover them you need an intact backup or, in rare cases, a decryption tool published for that specific ransomware family.
If I pay the ransom, will I definitely get my files back?
No. There is no guarantee that the key will be handed over or that it will work on all files, nor that the stolen data will be deleted. The authorities advise against paying, and those who pay risk being targeted again.
Is a backup on an external drive that is always connected enough?
No. A drive that is always connected to the computer or the network gets encrypted along with everything else. At least one copy must be disconnected, or immutable, meaning it cannot be changed for a set period.
Is a ransomware attack a data breach under the GDPR?
Very often, yes: even the mere unavailability of personal data is a breach. You need to assess whether there is a risk to the people concerned; if so, you must notify the Garante within 72 hours of discovery and, if the risk is high, also inform the people concerned.
Does ransomware also affect Macs and NAS devices?
Yes. There is ransomware for macOS, Linux and for NAS devices, the network storage units that are very common in professional offices. No system is immune: what matters are updates, protected access and backups.
How long does it take to get back up and running after a ransomware attack?
It depends mainly on the quality of your backups and how prepared you are. With recent backups and a tested procedure you can be up and running again in one or two days; without them, the downtime can last weeks and some data may be lost for good.
Sources and further reading
- Data Breach Investigations Report — Verizon, 2025 edition.
- Verizon 2025 DBIR: summary of findings — Help Net Security, 23 April 2025.
- #StopRansomware Guide — CISA, MS-ISAC, NSA, FBI.
- ENISA Threat Landscape 2025 — ENISA.
- Data breach: notifica al Garante (in Italian) — Italian Data Protection Authority (Garante privacy).
- Denuncia per reati telematici (in Italian) — Postal Police, Commissariato di PS Online.
Written by Ing. Sergio Florio, founder of Strega Byte, an engineer with over twenty years of experience across research, development and business. Article updated on 11 October 2026.
