Insights · Published 8 November 2026
Ransomware is malicious software that locks your files and demands payment to unlock them. One morning, staff find every document renamed, nothing will open, and a note on the screen asks for money, usually in cryptocurrency, with a deadline.
For a small business, this can stop work completely: no invoices, no accounts, no client records. Paying is a gamble. There is no guarantee the criminals will unlock anything, and paying marks you as someone who pays. The businesses that recover well are the ones that prepared, so they can restore their data without negotiating at all.
How it gets in
Ransomware does not usually arrive by magic. It comes through a small number of familiar doors.
- An email attachment or link that a staff member opens
- Remote desktop left open to the internet with a weak password
- Old software and systems that have not had security updates
- Cracked software and fake activation tools carrying hidden malware
- A stolen password for email, remote access or a VPN
- An infected USB drive brought from home or a business centre
Close the common doors
Keep everything updated. Windows, Office, browsers, your server and your router all get security updates, and many attacks use holes that were fixed long ago. Make sure updates are installing automatically, and replace systems that no longer receive updates.
Never leave remote desktop open directly to the internet. If staff or your IT provider need remote access, use a secure method with two-step verification. Ask whoever set up your router to confirm nothing is exposed that should not be.
Turn on two-step verification for email and remote access. Use reputable antivirus and keep it switched on. Avoid cracked software entirely.
Limit admin rights
When staff use computers with full administrator rights, any malware they run gets the same power. It can switch off antivirus, install itself deeply and spread across the network.
Day-to-day accounts should be standard users. Admin rights should belong to a separate account used only when installing software or changing settings. On shared folders, give people access only to the folders they need. If one laptop is infected, it can then damage far less.
Backups are your way out
The thing that lets you say no to a ransom is a recent backup the attackers could not reach. Modern ransomware looks for backups and destroys them first, so a drive permanently plugged into the server is not enough.
Keep at least one copy offline or locked: a drive that is disconnected and stored away, or a cloud backup with retention lock so it cannot be deleted for a set period, even by someone with your passwords. Test restoring from it regularly. If you have never restored from it, you do not know that it works.
Write a simple plan
When ransomware strikes, people panic and make it worse, for example by switching on infected machines, plugging the backup drive in to check it, or paying quickly before thinking. A one-page plan helps everyone act calmly.
It should say who to call first (your IT provider, with their number written down, not only stored on the computer that may be locked), how to disconnect affected computers from the network without wiping them, who decides on next steps, how to keep the business running on paper or phones in the meantime, and who will talk to customers, staff and, where needed, your bank and the police.
If personal data may have been affected, take advice on your obligations under Ghana's data protection law from a qualified professional.
If it happens
Disconnect affected computers from the network and Wi-Fi, but do not switch them off or wipe them yet, because they may hold evidence. Do not connect your backup drives. Call your IT provider. Change passwords for email and key systems from a clean device. Then work through recovery: find how the attackers got in and close that door, rebuild or clean affected machines, and restore data from your clean backup.
Restoring without closing the door first can mean being hit again a week later.
Your checklist
Use this to check where you stand.
- Confirm updates install automatically on every computer and server
- Check nothing like remote desktop is exposed to the internet
- Turn on two-step verification for email and remote access
- Remove admin rights from everyday staff accounts
- Keep one backup copy offline or locked against deletion
- Test a restore from that copy
- Write a one-page ransomware plan and print it
Dalysie Ghana can review how exposed you are, set up backups that ransomware cannot reach, and help you write and test a recovery plan.