Ransomware protection: what a small business should prepare

In short: According to the security company Cyble, ransomware groups published the data of 1,034 organisations in August 2026, which means a new victim in less than an hour on average. For a small business, the minimum protection against ransomware comes down to staff habits: how people handle email and attachments, and what software they are allowed to install. The rest is deciding in advance who makes the call on paying a ransom.

How fast ransomware attacks are piling up

The number of victims in August 2026 was almost double the figure for June. According to Tuổi Trẻ on 30 September 2026, The Ransomware Brief from the Cyble Research and Intelligence Labs (CRIL) recorded 1,078 attacks in August. Of those, 1,034 victims had their data published, about 33 victims a day on average.

That is 25% more than July (859 victims) and 101% more than June (536 victims). Between March and June the groups went quiet for a while to reorganise and grow their networks of affiliates, the partners who carry out attacks for them. The article quotes the view that this rise is a new trend rather than a one-off spike.

Asia-Pacific accounted for 143 victims, 13% of the global total. The article gives no separate figure for Vietnam. Even so, Kaspersky data cited alongside it shows that ransomware is still the top threat for small and mid-sized businesses in Southeast Asia, Vietnam included.

Who the attackers target and how they demand money

Victims are concentrated in industries that suffer badly when operations stop: manufacturing (151), professional services (147), information technology (126) and healthcare (98). According to the article, attackers pick places where even an hour of downtime costs money, or places that hold sensitive data, so the pressure to pay is high.

The demands have also become harsher. Besides encrypting data, attackers copy customer records and trade secrets, then threaten to publish them if the victim does not pay. This is usually called double extortion: a business that has backups and can restore its own systems still faces the threat of a data leak. The report also notes that AI is being used to break in faster through poorly secured internet-facing services, which we covered in AI hacked 10+ servers in 3 hours.

How does ransomware usually get into a small business?

In a small business, ransomware usually gets in through ordinary things employees do every day. The article does not say how each attack got in. The three familiar routes are:

• Fake emails and attachments. Messages posing as invoices, quotes or delivery notices, with a password-protected archive, a Word or Excel file that asks you to "enable content" (macros), or a link to download a document. Accounting and purchasing staff get this kind of email every day, so they are the most likely to open one by mistake.
• Leaked or reused passwords. When one password is used on many sites, a leak on one site lets attackers try it on the company's email or VPN.
• Cracked software. Pirated copies of Office, design software or licence activation tools downloaded from unknown sites can install malware along with them. Employees install these for convenience, and the owner usually never finds out.

All three are easier to block with rules than with equipment. The article also advises against rushing to buy lots of expensive solutions and suggests tightening the core basics first.

What to do now to reduce the risk

Your current IT person or outsourced IT partner can do most of this within a month.

Task	Who does it	Done when
Attachment rule: do not open password-protected archives, executable files (.exe, .js, .iso) or documents that ask to enable macros from unknown senders	Director issues it	Every employee has signed it
Show file extensions in Windows so staff can see that "invoice.pdf.exe" is a program	IT	Turned on for every computer
A "clicked by mistake" channel: whoever opens a suspicious file unplugs that computer from the network and reports it straight away	Director	Everyone knows the number to call
Staff have no admin rights on their computers; they ask IT to install software	IT	Software on every computer has been reviewed
Turn on multi-factor authentication (MFA) for email, VPN and admin accounts	IT	No email account relies on a password alone
Keep servers and accounting computers off the guest Wi-Fi	IT	A one-page network diagram exists
Keep one offline backup and test restoring it	IT	Restore time has been recorded

The "clicked by mistake" channel only works if people who report early are not punished. If they fear blame, they keep quiet, and the malware gets hours more to spread to other machines. For MFA, the article recommends a phishing-resistant kind. A one-time code sent by text message can still be typed into a fake login page, while a physical security key or a passkey cannot.

Rules only become habits when they are repeated. Once a month, department heads can spend 15 minutes of a team meeting going through a phishing email the company has just received. To see where your company stands, question 11 in our digital transformation self-assessment questionnaire asks exactly about backups and test restores.

Who decides whether to pay the ransom?

The director or a delegated person decides, following rules written down before any incident happens. When the ransom note appears on screen, the person sitting at that computer is under the most pressure and may message the attackers on their own just to make it stop. The rules only need a few lines signed by the director:

• Nobody except the director or the delegated person contacts the attackers.
• Before any talk of money, find out whether the backups still work and what data has been taken.
• Consult a lawyer and report the incident to the police before paying anything.

Paying does not guarantee you get the data back. According to the article, victims who paid can still be cheated, never receive their data, or be extorted again and again. With double extortion, the attackers keep the copy they took, and the business has no way to check that it has been deleted.

Frequently asked questions

If we have backups, do we still need to worry? Yes. Backups let you restore locked computers, but they do not stop attackers from threatening to publish the data they stole.

Can antivirus software stop ransomware? Only partly, mostly known malware samples. When an employee lets a file run, or switches off the antivirus to install cracked software, this layer of protection is almost useless.

---

HAT Solutions helps small and mid-sized businesses write rules for how staff use email, software and data, review admin rights on each computer, and build this work into their digital transformation roadmap. Contact us for advice. Data security rules and the law on personal data are covered in our pillar article AI governance for business: a control framework and data security.