Ransomware is malicious software that locks or steals your files and demands payment to release them. Modern attacks often do both: they encrypt your systems and copy sensitive data, then threaten to publish it. For a small business, a successful attack can mean days or weeks of downtime, difficult conversations with clients and real legal obligations.
The good news is that most ransomware relies on a handful of common weaknesses. Close those gaps and you become a far less attractive target. Use the checklist below to see where your business stands.
How ransomware usually gets in
- Phishing emails that trick someone into opening an attachment, clicking a link or entering a password on a fake login page.
- Stolen or reused passwords, especially for email and remote access accounts without multi-factor authentication.
- Unpatched software with known vulnerabilities, including firewalls, VPNs and older servers.
- Exposed remote access, such as Remote Desktop opened directly to the internet.
Prevention checklist
Lock down accounts
- Turn on multi-factor authentication (MFA) for email, Microsoft 365 or Google Workspace, VPNs, banking and any cloud app that holds business data.
- Give staff standard user accounts. Reserve administrator rights for the few people who truly need them, and use separate admin accounts for admin work.
- Remove access for former employees and contractors on their last day.
- Use a business password manager so people stop reusing passwords.
Keep systems patched and protected
- Install operating system and application updates on a regular schedule, and don’t forget firewalls, routers and VPN appliances.
- Replace computers and servers that no longer receive security updates.
- Run endpoint detection and response (EDR) on every computer and server, ideally monitored around the clock, so suspicious behaviour is stopped, not just logged.
- Never expose Remote Desktop directly to the internet; put remote access behind a secure gateway with MFA.
Filter email and train your people
- Use advanced email filtering that scans links and attachments and flags impersonation attempts.
- Add external-sender warning banners so staff can spot outside emails pretending to be internal.
- Run short, regular security awareness training and simulated phishing tests. People are your best early-warning system when they know what to look for.
Recovery checklist
Even well-protected businesses should plan for the possibility that something gets through. Recovery planning is what turns a disaster into an inconvenience.
- Follow the 3-2-1 rule: three copies of your data, on two different types of storage, with one copy off-site.
- Keep at least one backup copy that is immutable or offline, so ransomware can’t encrypt or delete it.
- Back up cloud data too. Microsoft 365 and Google Workspace keep your service running, but restoring deleted or encrypted data is largely your responsibility.
- Test restores on a schedule and document how long recovery actually takes.
- Write a simple incident response plan: who to call, how to isolate systems, how to reach staff if email is down and where to find your insurance policy.
Often-missed gaps
Even businesses that have covered the basics are often caught out by the same few blind spots. Check these too:
- Old vendor and contractor accounts that still have remote access or administrator rights years after a project ended.
- Shared mailbox and service-account passwords that never change and aren’t protected by MFA.
- Network equipment firmware on firewalls, routers and Wi-Fi access points that hasn’t been updated since installation.
- Personal devices used for work email or files without any security requirements.
- Forgotten servers or PCs sitting in a closet, still connected to the network but no longer patched or monitored.
A short inventory review once or twice a year is usually enough to catch these before an attacker does.
Tip: cyber insurance applications increasingly ask about MFA, EDR, backups and staff training. Working through this checklist often makes renewal questionnaires much easier to answer, and helps make sure what you tell your insurer matches reality.
What Canadian and Ontario privacy laws expect
If an attack exposes personal information, your obligations don’t end once systems are restored. This is general information rather than legal advice, so speak with a privacy lawyer about your specific situation.
- PIPEDA applies to most private-sector organizations that collect personal information in the course of commercial activity. If a breach of security safeguards creates a real risk of significant harm to individuals, you must report it to the Office of the Privacy Commissioner of Canada and notify affected people as soon as feasible. You must also keep records of all breaches, even those that don’t meet the reporting threshold.
- PHIPA applies to health information custodians in Ontario, such as clinics and practitioners. Custodians generally must notify affected individuals at the first reasonable opportunity when personal health information is stolen, lost or accessed without authorization, and certain breaches must also be reported to the Information and Privacy Commissioner of Ontario.
- You can also report cyber incidents to the Canadian Centre for Cyber Security and to your local police.
Good records make all of this easier. Logs that show what was accessed, and when, can be the difference between a precise, limited notification and having to assume the worst.
If you’re hit: the first hour
- Disconnect affected devices from the network (unplug the cable or turn off Wi-Fi), but don’t power them off or wipe them. Evidence matters.
- Call your IT provider immediately, then your cyber insurer if you have one. Many policies require you to use their approved response team.
- Don’t contact the attackers or rush to pay. Payment doesn’t guarantee you’ll get your data back or that stolen data will be deleted.
- Change passwords from a clean device, starting with email and administrator accounts.
- Write things down: what you saw, when and who did what. You’ll need this for insurers and any breach reporting.
Where to start
If this list feels long, start with the items that stop the most attacks: MFA everywhere, regular patching, monitored endpoint protection and tested, immutable backups. Then build from there.
Want a second set of eyes? Data Trust Co helps GTA businesses put these protections in place through our ransomware protection and backup and disaster recovery services. Book a free IT assessment and we’ll show you exactly where your gaps are.