Ransomware extortion of small businesses : fonctionnement, signaux et que faire
Business fraud · alto
The attack usually starts with phishing, a password leaked or stolen by an infostealer, exposed remote access (RDP/VPN) without MFA, or an unpatched flaw in an edge device. Criminals explore the network for days, copy sensitive data and only then encrypt servers and backups.
Then comes the ransom note demanding crypto and threatening to publish the data on a leak site (double extortion). Some groups skip encryption altogether: they just steal and blackmail. There are also scammers who send "fake ransomware" emails claiming an attack that never happened.
According to the Verizon DBIR 2025, ransomware was present in 88% of breaches at small and mid-sized businesses. The FBI IC3 received 3,611 ransomware complaints in 2025, and Sophos found about half of attacked organizations paid a ransom.
Sinais / Signs
- Files with strange extensions that cannot be opened
- A ransom note on screen or in folders
- Antivirus disabled or backups deleted without explanation
- New admin accounts or remote access at odd hours
- Unusual outbound traffic suggesting data copying
Prevenção / Prevention
- Keep offline or immutable backups and test restores
- Require MFA on email, VPN, remote access and admin accounts
- Patch quickly, especially firewalls, VPNs and exposed servers
- Do not expose RDP to the internet
- Train staff against phishing and keep a response plan with contacts ready
- Consider cyber insurance and an incident response provider
O que fazer / What to do
- Isolate affected machines from the network without shutting everything down chaotically
- Engage incident response specialists and, if applicable, your insurer
- In the US, notify the FBI via IC3; in Brazil, file a police report
- Assess notification duties: the ANPD and data subjects in Brazil, state laws in the US
- Preserve logs and evidence before rebuilding systems
FAQ
Should we pay the ransom?
Authorities advise against paying: there is no guarantee of recovery or that data will be deleted, and payment may raise sanctions issues. The decision should involve specialists and legal counsel.
Am I too small to be a target?
No. Many attacks are opportunistic and go after any vulnerable access, regardless of size.
Radar
- — Ransomware at New Mexico hospital diverts ambulances, cancels surgeries. The BYOD group's attack on the University of New Mexico Health Sciences Center disrupted care. Source: The Record
- — Rhysida ransomware steals data from Berlin government network. The Rhysida group exfiltrated data from Berlin state's administrative network and is using it for extortion. Source: Help Net Security
- — Brazil ranks 3rd for ransomware victims in June 2026. According to Ransomware.live, Brazil had 23 victims in the month, behind the US (199) and Germany (49); Mexico had 14. Source: Ransomware.live (via TI Inside)
- — Ransomware grows 17.8% worldwide; Brazil is the 9th most targeted country. ISH Tecnologia counted 7,410 confirmed victim companies in 2025. Source: ISH Tecnologia (via Estado de Minas)
- — Ransomware complaints to the FBI rise to 3,611; reported losses top US$32m · > US$ 32 mi. In 2024 there were 3,156 complaints and ~US$12m. Akira, Qilin and INC/Lynx top the most-reported variants. Source: FBI IC3 2025 (via The Record)
- — Ransomware hits record in 2025 with 7,458 victims and 124 active groups · 7.458 vítimas. Of the 124 groups, 73 are new; the US accounts for 1,536 victims, followed by Canada (182) and Germany (167). Qilin dominates. Source: Searchlight Cyber (via TechRadar)
- — GuidePoint: ransomware victims grow 58% as Qilin leads with 1,044 attacks. Q4 2025 had 2,287 victims, the largest quarter on record; the number of groups rose 46% to 124. Source: GuidePoint Security, GRIT 2026 Report
- — Brazil is Latin America's No. 1 ransomware target, says Kaspersky · 549 mil tentativas. There were 549,000 blocked attempts (+12%) between Aug/2024 and Jun/2025, 1,664 a day and over half the regional total. Source: Kaspersky, Panorama de Ameaças 2025 (via Hardware.com.br)
- Ransomware in Brazil's government and healthcare: 2024–2026 cases
- Ransomware 2025–2026: most active gangs, top countries and Brazil
- Brazil's LGPD in practice: what the ANPD enforces and how to comply
- LGPD vs GDPR vs US law: privacy fines and breach notice deadlines
- Ransomware: pay or not? OFAC sanctions, insurance and the data
- How to build an incident response plan: the first 72 hours
FBI IC3 - Internet Crime Complaint Center · Verizon 2025 DBIR press release (via Officer.com) · Sophos - State of Ransomware 2025 · The Record - Cyber fraud surges to $17 billion (FBI IC3) · ANPD · CERT.br