Ransomware y extorsión a pequeñas empresas: cómo funciona, señales y qué hacer
Business fraud · alto
The attack usually starts with phishing, a password leaked or stolen by an infostealer, exposed remote access (RDP/VPN) without MFA, or an unpatched flaw in an edge device. Criminals explore the network for days, copy sensitive data and only then encrypt servers and backups.
Then comes the ransom note demanding crypto and threatening to publish the data on a leak site (double extortion). Some groups skip encryption altogether: they just steal and blackmail. There are also scammers who send "fake ransomware" emails claiming an attack that never happened.
According to the Verizon DBIR 2025, ransomware was present in 88% of breaches at small and mid-sized businesses. The FBI IC3 received 3,611 ransomware complaints in 2025, and Sophos found about half of attacked organizations paid a ransom.
Sinais / Signs
- Files with strange extensions that cannot be opened
- A ransom note on screen or in folders
- Antivirus disabled or backups deleted without explanation
- New admin accounts or remote access at odd hours
- Unusual outbound traffic suggesting data copying
Prevenção / Prevention
- Keep offline or immutable backups and test restores
- Require MFA on email, VPN, remote access and admin accounts
- Patch quickly, especially firewalls, VPNs and exposed servers
- Do not expose RDP to the internet
- Train staff against phishing and keep a response plan with contacts ready
- Consider cyber insurance and an incident response provider
O que fazer / What to do
- Isolate affected machines from the network without shutting everything down chaotically
- Engage incident response specialists and, if applicable, your insurer
- In the US, notify the FBI via IC3; in Brazil, file a police report
- Assess notification duties: the ANPD and data subjects in Brazil, state laws in the US
- Preserve logs and evidence before rebuilding systems
FAQ
Should we pay the ransom?
Authorities advise against paying: there is no guarantee of recovery or that data will be deleted, and payment may raise sanctions issues. The decision should involve specialists and legal counsel.
Am I too small to be a target?
No. Many attacks are opportunistic and go after any vulnerable access, regardless of size.
Radar
- — Ransomware en hospital de Nuevo México desvía ambulancias y cancela cirugías. El ataque del grupo BYOD al University of New Mexico Health Sciences Center interrumpió la atención. Fuente: The Record
- — El ransomware Rhysida roba datos de la red del gobierno de Berlín. El grupo Rhysida extrajo datos de la red administrativa del estado de Berlín y los usa para extorsión. Fuente: Help Net Security
- — Brasil es el 3er país con más víctimas de ransomware en junio de 2026. Según Ransomware.live, Brasil tuvo 23 víctimas en el mes, detrás de EE. UU. (199) y Alemania (49). Fuente: Ransomware.live (via TI Inside)
- — El ransomware avanza 17,8% en el mundo y Brasil es el 9º país más afectado. ISH Tecnologia contó 7.410 empresas víctimas confirmadas en 2025. Fuente: ISH Tecnologia (via Estado de Minas)
- — Las denuncias de ransomware al FBI suben a 3.611; las pérdidas superan US$ 32 millones · > US$ 32 mi. En 2024 hubo 3.156 denuncias y ~US$ 12 millones. Akira, Qilin e INC/Lynx encabezan las variantes. Fuente: FBI IC3 2025 (via The Record)
- — El ransomware bate récord en 2025 con 7.458 víctimas y 124 grupos activos · 7.458 vítimas. De los 124 grupos, 73 son nuevos; EE. UU. concentra 1.536 víctimas, seguido de Canadá (182) y Alemania (167). Fuente: Searchlight Cyber (via TechRadar)
- — GuidePoint: las víctimas de ransomware crecen 58% y Qilin lidera con 1.044 ataques. El 4T 2025 tuvo 2.287 víctimas, el mayor trimestre de la serie; los grupos subieron 46%, a 124. Fuente: GuidePoint Security, GRIT 2026 Report
- — Brasil es el objetivo número 1 de ransomware en América Latina, según Kaspersky · 549 mil tentativas. Hubo 549.000 intentos bloqueados (+12%) entre ago/2024 y jun/2025, 1.664 al día. Fuente: Kaspersky, Panorama de Ameaças 2025 (via Hardware.com.br)
- Ransomware en gobierno y salud en Brasil: casos 2024–2026
- Ransomware 2025–2026: most active gangs, top countries and Brazil
- LGPD en la práctica: qué fiscaliza la ANPD y cómo adecuarse
- LGPD vs GDPR vs US law: privacy fines and breach notice deadlines
- Ransomware: ¿pagar o no? Sanciones OFAC, seguros y datos
- How to build an incident response plan: the first 72 hours
FBI IC3 - Internet Crime Complaint Center · Verizon 2025 DBIR press release (via Officer.com) · Sophos - State of Ransomware 2025 · The Record - Cyber fraud surges to $17 billion (FBI IC3) · ANPD · CERT.br