Short answer
Ransomware is malicious software that locks or encrypts your files and demands payment to unlock them. The most effective protection is a backup kept offline that you've tested, plus genuine and updated software, two-step login on email and remote access, and staff who know how to spot suspicious emails. If you're hit, disconnect affected computers from the network immediately and get professional help before doing anything else.
What ransomware does
Ransomware encrypts files on a computer, and often on every computer and shared drive it can reach, so they can't be opened. A message then demands payment, usually in cryptocurrency, for a key to unlock them. Many attackers also copy your data first and threaten to publish it.
Small businesses are targeted because they often have no offline backups and weaker security than large companies.
How it usually gets in
- Phishing emails: an "invoice", "payment confirmation", "DHL delivery" or "shared document" with an attachment or link.
- Cracked software: "free" versions of Windows, Office, AutoCAD, games or activators downloaded from unofficial sites very often carry malware.
- Exposed remote access: Remote Desktop (RDP) or remote-support tools open to the internet with weak passwords.
- Unpatched systems: old, unsupported versions of Windows or software with known security holes.
- Infected USB drives passed between computers, cyber cafés and print shops.
How to protect your business
- Keep an offline backup and test it. This is what turns ransomware from a disaster into an inconvenience. Keep at least one copy disconnected from the network (an external drive unplugged after each backup, or a cloud backup with version history that staff can't delete). Test restoring files regularly.
- Use genuine software and keep it updated. Turn on automatic Windows updates; replace unsupported Windows versions.
- Turn on two-step login (2FA) for email, Microsoft 365/Google Workspace, banking and any remote-access tools.
- Close what you don't need. Don't expose Remote Desktop directly to the internet; use a VPN or a secure remote-support tool with 2FA, and remove remote tools you no longer use.
- Give staff standard accounts. Day-to-day work shouldn't be done on administrator accounts; that limits what malware can do.
- Use antivirus/endpoint protection on every computer and check that it's actually running and updating.
- Train staff for 15 minutes. Check the sender's real address, be suspicious of urgent payment requests and unexpected attachments, and call to confirm any change of bank details.
- Filter email. Business email with good spam filtering stops many phishing emails before anyone sees them.
Our small business IT checklist covers the wider basics: power, backups, Wi-Fi, accounts and staff changes.
Warning signs
- Files suddenly renamed with strange extensions, or that won't open.
- A ransom note on the desktop or in folders.
- Computers slowing down sharply while the hard drive is busy for no reason.
- Antivirus being switched off without anyone doing it.
If you're hit: the first hour
- Disconnect affected computers from the network: unplug the network cable and turn off Wi-Fi. Don't switch them off unless advised; evidence may be in memory.
- Disconnect backups if they're still attached, to protect them.
- Don't delete anything and don't run random "decryptor" tools from the internet.
- Call for professional help to identify what happened, what's affected, and how to restore safely.
- Change passwords for email and key accounts from a clean device, and turn on 2FA.
- Report it. Inform your bank if payment details may be involved, and consider reporting to the police cybercrime unit. If personal data was affected, the Nigeria Data Protection Act 2023 expects data controllers to notify the Nigeria Data Protection Commission promptly (within 72 hours of becoming aware of a breach that's likely to put people at risk).
Should you pay the ransom?
Paying doesn't guarantee you'll get your files back, it funds further attacks, and attackers may still publish or sell your data. Restoring from clean backups is the reliable way back, which is why the backup step above matters most.
Get help
We help Nigerian businesses with endpoint protection, network security assessments, staff security awareness training, backups and recovery. See IT services or WhatsApp us; if you've been hit, tell us straight away.
Protect your business
Talk to us about backups, endpoint protection and staff training. If you've been hit, WhatsApp us now.
Visit us: Yaba, Lagos · Owerri · +234 902 730 1128
Frequently asked questions
What is the best protection against ransomware?
A tested backup kept offline or protected from deletion, combined with genuine updated software, two-step login, antivirus on every computer and staff who can spot phishing emails.
How does ransomware get onto computers?
Most often through phishing emails, cracked or pirated software, remote access left open to the internet with weak passwords, unpatched systems and infected USB drives.
What should I do first if my business is hit by ransomware?
Disconnect affected computers from the network, disconnect any attached backups, don't delete anything, and get professional help. Change key passwords from a clean device.
Should I pay the ransom?
Paying doesn't guarantee your files back and attackers may still leak your data. Restoring from clean backups is the reliable route; get professional advice before making any decision.
Written by the ENB Technologies repair & IT team, reviewed by our technicians. Published .
ENB TECHNOLOGIES LIMITED (RC 7714368) repairs computers and supports businesses from offices in Yaba, Lagos and Owerri. This guide is general information; for your device, ask us for a diagnosis. How we write our guides.
