Many small businesses assume cybercriminals are only interested in large banks, government agencies and multinational companies. But small businesses can also be attractive targets because they often handle valuable information without having the same cybersecurity resources as larger organisations.

One threat business owners should understand is ransomware a type of malicious software that can lock access to files or systems, often by encrypting them, and demand payment to restore access.

For a small business, an attack could mean losing access to customer records, invoices, sales information, accounting files or operational systems. It can disrupt daily activities, delay payments, damage customer trust and create unexpected recovery costs.

Understanding how ransomware works is an important first step towards protecting a business.

What Is Ransomware?

Ransomware is malware designed to deny victims access to their data or computer systems until certain demands are met. Attackers commonly demand payment, sometimes in cryptocurrency, in exchange for a decryption key or to prevent stolen information from being published.

Some attacks focus on encrypting files. Others involve double extortion, where criminals steal sensitive information and threaten to release it, even if the victim has backups.

Paying the ransom does not guarantee that files will be restored or that stolen information will remain private.

How Does a Ransomware Attack Happen?

Ransomware attacks can begin with seemingly ordinary business activities. Common entry points include:

1. Fake emails and attachments

An employee receives an email that appears to come from a supplier, customer, delivery company or bank. The message may contain a fake invoice or a link to a fraudulent website. Opening a malicious attachment or entering login details on a fake page can give attackers an opportunity to gain access.

2. Stolen passwords

Criminals may use stolen or reused passwords to access business email, cloud storage, remote access services or other accounts. If an account lacks multi-factor authentication, it may be easier for an attacker to take control.

3. Unpatched software

Outdated operating systems, business applications, routers and other internet-connected devices may contain security weaknesses that attackers can exploit.

4. Compromised suppliers or service providers

A small business may depend on an external IT provider, software platform or shared business system. If one of these is compromised, it can create additional risks for connected organisations.

Why Are Small Businesses Attractive Targets?

Small businesses are not necessarily targeted because they have more money than large companies. They may be targeted because attackers see opportunities to get in, cause disruption and pressure the business to pay.

Limited cybersecurity budgets: Many SMEs cannot afford a dedicated security team, advanced monitoring or frequent professional security assessments.

Valuable business data: Customer contact details, payment records, contracts, payroll information and supplier databases can be useful to criminals.

Heavy dependence on digital tools: A business that relies on email, online payments, cloud documents, inventory software or digital booking systems may struggle when those services become unavailable.

Limited backup protection: Some businesses keep their only backup on the same computer or network as their main files. If ransomware reaches both, recovery may become much harder.

Pressure to resume operations: A small business may lose revenue quickly when it cannot process orders, serve customers or access its records. Attackers may exploit that urgency.

What Could a Ransomware Attack Cost an SME?

The impact can go beyond the ransom demand. Affected businesses may face:

  • Downtime: Employees may be unable to work or fulfil orders.

  • Recovery expenses: Restoring devices, rebuilding systems and engaging IT specialists can be costly.

  • Data exposure: Customer, employee or business information may be stolen.

  • Lost revenue: Customers may take their business elsewhere if services are disrupted.

  • Reputational damage: Clients and partners may lose confidence in the company's ability to protect information.

  • Legal and compliance obligations: Depending on the data and applicable rules, a business may need to investigate, notify affected parties or seek professional legal advice.

For Nigerian SMEs, disruptions to invoicing, customer communication, inventory management and electronic payment operations can affect cash flow and day-to-day service delivery.

How Can Small Businesses Protect Themselves?

An SME does not need a large cybersecurity department to improve its security. A few consistent practices can reduce the risk and make recovery easier. Nigeria’s ngCERT has also warned organisations about ransomware, phishing, stolen credentials and unpatched systems.

1. Back up important files

Back up customer records, invoices, accounting data and essential documents regularly. Keep a protected copy separate from the main network, preferably offline or in a properly secured backup service. Test restoration periodically; a backup is only useful if it works.

2. Enable multi-factor authentication

Add another verification step to business email, cloud storage, financial services and administrator accounts. Use unique, strong passwords and a password manager where possible.

3. Update software promptly

Install security updates for operating systems, business applications, routers and other devices. Replace software that no longer receives security support.

4. Train employees to spot suspicious messages

Teach staff to verify unexpected invoices, payment requests, links and attachments through a separate trusted channel. Never rely on the sender's display name alone.

5. Limit access to business information

Give employees access only to the files and systems they need. Review former employees' accounts, restrict administrator privileges and secure remote access.

6. Prepare an incident response plan

Decide who will disconnect affected devices, contact IT support, assess the damage and communicate with customers if necessary. Keep important contacts and recovery instructions accessible offline.

These measures align with small-business ransomware guidance from NIST, CISA and the FBI.

What Should a Business Do If It Suspects a Ransomware Attack?

Acting quickly can help limit the damage.

  1. Isolate affected devices. Disconnect suspected infected computers from Wi-Fi, Ethernet and shared networks to help prevent further spread. Avoid deleting files or wiping devices before receiving guidance.

  2. Contact qualified IT or cybersecurity support. Investigate the extent of the incident and secure unaffected systems.

  3. Protect backups and other accounts. Check whether backup systems and administrator credentials may also have been compromised.

  4. Preserve evidence. Keep ransom notes, suspicious emails, timestamps and relevant system logs for investigation.

  5. Recover carefully. Restore clean backups only after the underlying security problem has been addressed.

  6. Seek appropriate reporting and legal guidance. In Nigeria, organisations can contact ngCERT through its official channels for incident support. If personal data may have been exposed, assess applicable obligations under Nigeria's data-protection framework.

Do not rush into paying a ransom. Payment does not guarantee file recovery or prevent stolen information from being published. Seek expert advice before making decisions.

Final Thoughts: Cybersecurity Is a Business Priority

Ransomware is not just an IT problem. It is a business continuity, financial and customer-trust problem.

Small businesses can reduce their exposure by protecting accounts, updating software, training employees and maintaining tested backups. These measures cannot eliminate every threat, but they can make an attack less likely to succeed and less damaging if one occurs.

The best time to prepare for a ransomware attack is before your business loses access to its files.