Key Takeaways
- The risk to your company: a single ransomware attack can stop operations for days, expose client and staff data, and trigger police, privacy and regulatory reporting at the same time.
- Ransomware is malicious software that encrypts your files and demands payment; most gangs now steal data first, so backups alone do not end the threat.
- The main ways in are phishing emails, exposed remote access, unpatched firewalls, VPNs and NAS devices, and stolen passwords.
- Four habits prevent most attacks: patch quickly, use multi-factor authentication everywhere, keep one backup offline on a separate login, and get staff to report suspicious emails fast.
- If you are hit: disconnect affected machines but keep them powered on, preserve evidence, and call HKCERT on 8105 6060 and the police.
Monday, 8:45 a.m. Nobody in the office can open a spreadsheet. Every file ends in a strange extension, and a text note on the server says your data has been copied and will be published in seven days unless you pay.
That is ransomware. This guide explains what it is, how it gets in, and what you can do this week to make your company a much harder target.
What is ransomware?
Ransomware is malicious software that locks or encrypts a company's files and systems, then demands payment, usually in cryptocurrency, for the key to unlock them. Most modern gangs also steal data before encrypting it and threaten to publish it, so a working backup no longer removes all of the pressure.
Think of it as a burglar who changes every lock in your office, takes a photocopy of your filing cabinet on the way out, and leaves a note with a price.
Ransomware is now run like a business. Under ransomware-as-a-service (RaaS), developers rent their tools to affiliates who break in and split the ransom, as HKCERT's Fight Ransomware page explains.
Hong Kong Police recorded 43 ransomware cases among 31,571 technology crime cases in 2025, according to the Cyber Security and Technology Crime Bureau's Cybersecurity Report 2025. That figure counts only cases reported to police.
How does a ransomware attack work?
A typical attack runs in five stages: the attacker gets in, moves quietly around the network for days or weeks, copies valuable data, disables or deletes backups, and finally encrypts everything at once, often at night or over a weekend when fewer people are watching.
A local example: in June 2026, bakery chain Kee Wah said its internal network had been hit by ransomware, potentially affecting data on employees, business partners, online customers and members. It reported the case to the Privacy Commissioner and the police while its shops stayed open (The Standard, June 2026).
The five stages
- Entry: a stolen password, a phishing email or an unpatched internet-facing device.
- Movement: the attacker collects administrator passwords and maps file servers, email and backups.
- Theft: client lists, contracts, HR and finance files are copied out.
- Sabotage: backups are deleted and security tools switched off.
- Encryption and ransom note: files are locked and a payment deadline is set.
Every common way in
- Phishing emails with attachments or links that install malware or steal passwords
- Remote access open to the internet (Remote Desktop, VPN, remote support tools) with weak or reused passwords
- Unpatched edge devices such as firewalls, VPN gateways and NAS storage boxes
- Passwords sold online after an infostealer infects a staff laptop or home PC
- An IT supplier whose remote access to your systems is abused
- Pirated software, fake browser updates and infected USB drives
Hong Kong Police's review of 2025 incidents found that remote access services and edge devices remained the main intrusion routes, and that backups sharing the same login as live systems were often destroyed together (Cybersecurity Report 2025). HKCERT has also warned users of remote access tools and NAS devices to watch for ransomware.
What are the main types of ransomware?
Ransomware comes in four main forms: crypto ransomware that encrypts files, locker ransomware that blocks access to a whole device, double extortion that steals data before encrypting it, and pure data extortion, where nothing is encrypted at all and the threat is publication alone.
| Type | What it does | What it means for a company |
|---|---|---|
| Crypto ransomware | Encrypts files and databases | Work stops until you restore from backup or obtain a key |
| Locker ransomware | Locks the screen or device | Less common on business servers; still disruptive on PCs |
| Double extortion | Steals data, then encrypts | Even with good backups you face a leak threat and privacy duties |
| Data extortion only | Steals data, no encryption | Systems keep running, but clients and regulators may still need to know |
Most attacks reported in the news today are double extortion. That is why the question has shifted from "can we restore?" to "what did they take?"
How can you tell if ransomware is in your systems?
The obvious sign is files that suddenly will not open and carry an unfamiliar extension, plus a ransom note on screens or in folders. The earlier warnings are quieter: new administrator accounts, antivirus switched off, backup jobs failing, and large uploads outside office hours.
- New or unknown administrator accounts appear
- Antivirus or endpoint protection is disabled on several machines
- Backup jobs fail or backup files are deleted
- Large data transfers at night or over weekends
- Staff report password reset emails or MFA prompts they did not request
- Files renamed in bulk with a new extension and a text file in every folder
Treat any of the early signs as an incident now. Encryption is usually the last step of an attack, not the first, so spotting the quiet signals buys you time.
How do you prevent ransomware?
Prevention rests on four habits: keep systems patched, protect every login with multi-factor authentication, keep at least one backup offline on a separate login, and train staff to report suspicious emails quickly. None is expensive; most incidents start from one forgotten exception, such as an old remote access account.
For individuals: phone and PC settings
- iPhone updates: Settings → General → Software Update → Automatic Updates → turn on iOS Updates
- iPhone backup: Settings → [your name] → iCloud → iCloud Backup → turn on Back Up This iPhone
- Android updates: Settings → System → Software updates (Samsung: Settings → Software update → Auto download over Wi-Fi)
- Android backup: Settings → System → Backup → turn on Backup by Google One
- Windows 11 PC: Settings → Privacy & security → Windows Security → Virus & threat protection → Ransomware protection → turn on Controlled folder access
Paths compiled in November 2026; menu names vary by operating system version and phone brand.
For SMEs and IT teams
- Close Remote Desktop to the internet; put remote access behind a VPN with multi-factor authentication (MFA)
- Patch firewalls, VPN gateways and NAS devices within days of a critical fix
- Follow the 3-2-1 rule: three copies, two types of media, one offline or immutable, protected by a separate login
- Test a full restore every quarter, not just the backup job
- Give staff standard accounts and keep administrator rights to named IT staff
- Keep security logs for at least 90 days; police found missing logs badly slowed 2025 investigations
- Test your internet-facing systems independently at least once a year, because attack surface management is a top priority in the police's 2025 lessons
Company scenario: when the "boss" needs a payment today
Ransomware groups often read a company's mailbox for weeks before they strike. Some then reuse real invoices to email clients with "new bank details", or pose as a director asking finance for an urgent payment to "settle the problem quietly".
Company rule: no change of payee bank details and no urgent payment is processed until finance calls the requester on a number already on file, never one given in the message. Any decision about a ransom is made by the directors with legal advice, never by one person.
Staff notice to copy into your WhatsApp group
[IT notice] Ransomware alert: do not open unexpected attachments or "invoice" links, even from people you know.
If files will not open or show a strange new extension: unplug the network cable or turn off Wi-Fi, do NOT shut down the PC, and call IT on [number] now.
Finance: verify every change of bank details by calling a number we already have on file.
Thank you.60-second self-check
- Is Remote Desktop closed to the internet?
- Does every email and remote access account use MFA?
- Is at least one backup offline, on a different login?
- Have you restored a file from backup in the last 90 days?
- Do staff know exactly who to call if files stop opening?
What should you do if you are hit by ransomware?
Isolate first: disconnect affected machines from the network but leave them powered on, then call your IT lead. Preserve evidence, check whether backups survived, and report to the police and HKCERT. Take legal advice before any contact with the attackers or any decision about paying.
- Isolate: unplug network cables, turn off Wi-Fi and disconnect shared drives. Do not power off, because memory may hold evidence.
- Preserve: photograph ransom notes and screens; do not wipe or reinstall anything yet.
- Secure accounts: from a clean device, reset administrator, email and remote access passwords.
- Report: call the police (999 if urgent) and HKCERT's 24-hour hotline 8105 6060.
- Personal data: if client or staff data may be exposed, assess notifying the Privacy Commissioner (PCPD) and the people affected.
- Critical infrastructure operators: under Cap. 653, serious incidents must be reported within 12 hours of becoming aware, others within 48 hours.
- Look for a free key: some older ransomware families can be decrypted with free tools on No More Ransom.
Be wary of anyone who calls offering to "recover" your data or money. HKCERT warned in May 2026 of fake websites impersonating the police Anti-Deception Coordination Centre (HKCERT alert). Check unknown numbers or sites on Scameter, or call the Anti-Scam Helpline 18222 (ADCC).
What is the difference between ransomware and other malware?
All ransomware is malware, but most malware is not ransomware. Viruses, trojans and spyware usually try to stay hidden while they steal or damage quietly. Ransomware wants to be found, because its business model depends on you seeing the note and paying, which is why it causes immediate downtime.
In practice the two are linked. An infostealer that quietly grabs saved passwords today is often how a ransomware affiliate gets in next month, so cleaning up "minor" malware infections quickly is itself ransomware prevention.
Ransomware is a business continuity risk, not only an IT problem
Ransomware succeeds when small gaps line up: one open remote login, one unpatched device, one backup on the same password as everything else. Close those gaps, rehearse the first hour of a response, and give finance a simple verification rule.
You will not make your company impossible to attack. You can make it slower, noisier and less profitable to attack than the next one, and that is usually enough.
Find the open doors before attackers do
Ransomware almost always enters through a gap that could have been found earlier: an exposed login, an unpatched device, a weak internal path. A penetration test has certified ethical hackers try those routes under agreed rules, then gives you a ranked fix list and a retest to confirm the fixes hold.
Frequently Asked Questions
Should a company pay the ransom?
Security agencies including HKCERT generally advise against paying. Payment does not guarantee a working key or that stolen data is deleted, and it funds further attacks. Make any decision with legal counsel and, if insured, your insurer.
Is antivirus software enough to stop ransomware?
No. Antivirus helps, but attackers often log in with stolen passwords and switch it off first. You also need MFA, prompt patching, offline backups and monitoring of unusual activity.
Can encrypted files be recovered without paying?
Sometimes. Restore from a clean offline backup first. For some older ransomware families, free decryption tools are available on the No More Ransom project run by law enforcement and security companies.
Does cyber insurance cover ransomware attacks?
Many policies cover incident response and business interruption, but terms vary and insurers often require MFA and backups to be in place. Check your wording and the insurer's notification deadline before an incident.