Ransomware: a practical checklist for small businesses

Ransomware locks files or systems, or steals data and threatens to publish it, until a payment is demanded. The Canadian Centre for Cyber Security’s National Cyber Threat Assessment 2025–2026, cited in its ransomware playbook, treats ransomware as the top cybercrime threat to Canada’s critical infrastructure. Small and medium businesses are not outside that risk: if you cannot open invoices, email or shared files, work stops.

How it usually starts

The Cyber Centre’s playbook lists common ways ransomware gets in: unsafe or compromised websites, infected attachments, malicious links, infected USB drives, and systems left on the internet without updates, monitoring or multi-factor authentication. Paying does not guarantee that you will get your data back or that copies will be deleted.

Before an incident: controls that still matter

• Keep an offline or otherwise isolated backup of the data you cannot afford to lose, and test that you can restore it.
• Apply security updates on PCs, servers, firewalls and routers. End-of-life systems that no longer receive patches are a known path in.
• Turn on multi-factor authentication for email, remote access and cloud admin accounts.
• Limit who can install software and who has administrator rights.
• Filter email and teach staff not to run unexpected attachments or “paste this command to continue” prompts.
• Write down who to call, how you will communicate if email is down, and which systems you would isolate first. The Cyber Centre treats an incident response plan as the starting point, not an optional extra.

If you think ransomware is already running

• Disconnect affected devices from the network and from the internet so the infection is less likely to spread.
• Do not wipe systems before you have recorded what you can about the incident, unless your incident plan says otherwise.
• Use a separate, clean device to contact IT support, your insurer if you have cyber cover, and — in Canada — local police, the Canadian Anti-Fraud Centre and the Cyber Centre.
• Restore from a backup only after you know the backup is clean. The playbook warns that restoring onto a still-infected network can encrypt the recovered files again.

CISA’s StopRansomware site is a further public checklist for prevention and response. Neither CISA nor the Cyber Centre can run your recovery for you; they publish the steps organisations should take with their own IT support.

How Techloom can help

Techloom can help you review backups, updates, endpoint protection and remote access before an incident, and can assess what to fix first after one. That work is scoped in a security assessment or ongoing managed IT support. We do not guarantee that any control prevents every attack.

Sources

Ransomware playbook (ITSM.00.099), Canadian Centre for Cyber Security. Developing your incident response plan (ITSAP.40.003), Canadian Centre for Cyber Security. StopRansomware, CISA.