How do I know if my small business has ransomware?
Key takeaways
- Files renamed with an unfamiliar extension plus a readable note in the same folder is the clearest ransomware confirmation available to a non-technical owner.
- Multiple systems failing simultaneously, with security tools or backup jobs suddenly disabled, indicates ransomware rather than a single hardware failure.
- CERT-In directions require a log to CERT-In or a law-enforcement incident report within 6 hours of being informed of a cyber incident.
- Never open a ransom note on a domain-joined machine, because the note's URL and the machine's credentials can make a second machine a victim.
- Take photographs of the note and the file properties, and preserve the file timestamps, before contacting anyone who might ask you to reinstall the system.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What are the signs of ransomware in a small business?
Six, in rough order of reliability. One: a ransom note, usually a new text file, HTML file or desktop wallpaper with instructions and a payment demand. Two: files renamed with an unfamiliar extension, or originals that will not open, often on the file server first because that is where the data sits. Three: several machines failing at the same time, which points to a shared file server rather than local hardware. Four: antivirus, backup jobs or the ability to create new files disappearing, which is deliberate anti-recovery behaviour. Five: a sudden drop in activity on shared drives and on the accounting system. Six: unexplained outbound traffic or cloud uploads, which suggests exfiltration before encryption. One of these is a prompt to check; several together is a strong indication.
How do I confirm it without making it worse?
Confirm in about 20 minutes, from a device that is not on the office network. First, look at a shared folder read-only and note whether file names have changed extension. Second, check the properties of one affected file and one healthy file, and compare the modified timestamps, which will be clustered. Third, if a ransom note exists, photograph it rather than opening it on a domain machine, because opening it can trigger a URL that fetches the network share credentials. Fourth, check the backup server and confirm the backup job did not run. If the affected file names all share one new extension and the timestamps cluster, you have ransomware and you should move to containment immediately rather than continue investigating.
What is the difference between ransomware and a failed disk or antivirus issue?
Three reliable discriminators. Ransomware renames or encrypts many files across a share, so a healthy file from last week will not open either. It leaves a note, and the note's language and payment demand are the giveaway. And it disables recovery, so a backup job that stopped running or security software that will not start is a behavioural signal rather than a hardware one. A failed disk affects one machine or one share, with the rest working, and it leaves no note. A misconfigured antivirus update can disable a product briefly, but it does not rename files. If you are not sure, treat it as ransomware and isolate, because the cost of unnecessary isolation is hours, and the cost of not isolating is the whole estate.
What do I do in the moment I am sure?
Act on the same checklist you would for a confirmed incident, because certainty does not change the priorities. Isolate the affected machines from the network without powering them off, photograph the note and the file properties, disconnect shared drives and stop cloud sync clients, and note the time you first noticed it. Then call a forensics-capable responder and your bank, because where the incident involved financial data, the fraud clock is short. And complete the CERT-In reporting obligation: the directions require a log to CERT-In or a law-enforcement incident report within 6 hours of being informed. Do not pay, do not wipe, and do not restore until the estate has been scoped.
| Sign | What it suggests | Confirm by |
|---|---|---|
| New ransom note file | Full extortion by the operator | Photograph it, do not open it on a domain machine |
| Files renamed with a new extension | Encryption has run across the share | Compare file properties and timestamps |
| Many machines failing together | Shared file server was the target | Test one file per share from a clean device |
| Antivirus or backup jobs stopped | Deliberate anti-recovery behaviour | Check the backup server and the security console |
| Sharp drop in shared-drive activity | Encryption in progress | Compare folder sizes and file counts |
What are the frequently asked questions?
Get a straight answer on this
Call our 24-hour ransomware line if you see a ransom note, and we will confirm remotely before you touch the affected machines.
Send us the details See pricing