Ransomware does not discriminate by organization size. Small businesses are targeted specifically because attackers know they typically have less security infrastructure, fewer IT resources, and more pressure to pay quickly to restore operations than larger organizations.
If ransomware is active in your small business right now, this article tells you exactly who to call, in what order, and what to expect from each resource. If you are reading this before an incident to prepare, it tells you what to put in place so that if the day comes, your team knows what to do without searching for answers under pressure.
The sequence matters. The calls made in the wrong order create coverage problems, legal exposure, and delays that extend the damage. The calls made in the right order engage the right resources at the right time and preserve your recovery options.
What Small Businesses Face That Larger Organizations Do Not
The ransomware challenge for small businesses is not a smaller version of the enterprise challenge. It has specific characteristics that require specific responses.
No dedicated IT or security team. Most small businesses do not have an internal IT department, let alone a security operations function. The person who manages IT is often an office manager, a technically inclined employee, or the business owner themselves. That person has no ransomware response experience and no specialized tools. When ransomware hits, they are managing an incident that requires specialized expertise they have not developed.
Higher operational pressure to pay. A small business with ten employees whose systems are encrypted cannot sustain operations through manual workarounds as long as a large organization can. Every day of downtime is a higher percentage of monthly revenue, and the pressure to restore operations quickly pushes toward payment decisions that may not be the best recovery path.
Less cyber insurance coverage. Small businesses that carry cyber insurance often carry lower limits, higher deductibles, and narrower coverage than larger organizations. Some small businesses have no cyber insurance at all, which removes the primary funding mechanism for professional incident response and recovery costs.
Fewer pre-established resources. Large organizations have legal counsel on retainer, established incident response vendor relationships, and documented incident response plans. Small businesses typically have none of these before an incident, which means the first hours of a ransomware event are spent finding resources that should have been identified in advance.
Understanding these differences clarifies what small businesses specifically need to prepare and what to expect when an incident occurs.
Who to Call First: The Small Business Emergency Sequence
Call One: Your Cyber Insurance Provider
If you have cyber insurance, this is your first call. Make it before anything else, including before calling your IT person or your internet provider.
Your cyber insurance carrier’s emergency line initiates the covered response. The carrier will connect you with a breach coach, typically a legal professional who coordinates the response and ensures that subsequent decisions preserve your coverage. The breach coach will authorize engagement of approved incident response vendors and guide the legal and regulatory decisions that begin immediately following a ransomware event.
The most common small business mistake in ransomware response is engaging an IT person or a recovery service before notifying the insurance carrier. Costs incurred before insurer notification, or vendor engagements made without insurer approval, may not be covered under the policy. This is a coverage gap that cannot be undone after the fact.
To make this call, you need: your policy number, the carrier’s emergency line number, and a description of what you are observing. You do not need a complete assessment before calling. Call immediately and update as you learn more.
If your policy number and emergency line contact are stored in your email system and your email system is affected, you cannot access them when you need them most. After this incident, print this information and keep it in a physical location accessible without computer access.
Call Two: Your Managed IT Provider or IT Support Contact
If you have a managed IT provider, call them immediately after notifying your insurance carrier. Your managed provider may have incident response capability or established referral relationships with incident response specialists. They can begin remote containment guidance while professional incident response resources are mobilized.
If you do not have a managed IT provider and your IT support is a freelance technician or an employee without ransomware response experience, do not rely on them to manage the technical response. They can assist with physical actions like disconnecting network cables, but the ransomware-specific technical work requires specialized expertise that most generalist IT support contacts do not have.
If you have no IT support at all, your cyber insurance carrier’s breach coach will connect you with approved vendors who can provide both immediate technical guidance and on-site response capability.
Call Three: Legal Counsel
Legal counsel must be engaged in the first few hours of the incident. For small businesses that do not have outside counsel on retainer, the breach coach provided by the cyber insurance carrier serves this function initially. If your business is in a regulated industry including healthcare, financial services, or legal services, industry-specific legal expertise is additionally required because regulatory notification obligations in those industries require specialized knowledge to navigate correctly.
The legal work that begins immediately includes assessing whether customer, patient, or employee data on affected systems triggers breach notification obligations, advising on the payment decision including sanctions screening of the attacker group, and reviewing all external communications before they are made.
Do not make any public statement, customer communication, or media statement before legal counsel has reviewed it. Statements made during an active ransomware incident have legal implications that unreviewed communication can create or worsen.
Call Four: The FBI Internet Crime Complaint Center
File a report with the FBI IC3 at ic3.gov. This report is recommended for all ransomware incidents and is required in some regulated industries. Filing takes approximately 15 minutes and does not slow your recovery. The FBI IC3 report initiates law enforcement awareness that may provide threat intelligence about the attacker group relevant to your response, and it documents that your business reported the incident promptly, which matters for regulatory compliance and insurance purposes.
If you are a healthcare provider, the FBI IC3 report supplements but does not replace the HHS breach notification obligation. If you are a financial services provider, it supplements but does not replace financial regulatory notification obligations. Both reports are required in those industries.
What to Expect From Each Resource
What Cyber Insurance Provides
Cyber insurance for small businesses typically covers breach response costs including incident response vendor fees, legal counsel fees, forensic investigation, customer notification costs, and credit monitoring for affected individuals. Business interruption coverage reimburses lost revenue during the period systems are unavailable, typically after a waiting period of 8 to 24 hours. Ransomware payment coverage is included in most policies subject to insurer approval and OFAC compliance.
What cyber insurance does not automatically provide: coverage for all costs without conditions. Prompt notification, approved vendor engagement, and compliance with policy conditions during the response are requirements for full coverage. Small businesses that are unfamiliar with their policy terms frequently discover coverage gaps during the claims process that would have been avoidable with advance policy review.
The deductible on small business cyber insurance policies ranges widely. Know your deductible before an incident so that cost decisions during the response are made with accurate information about out-of-pocket exposure.
What Incident Response Firms Provide
Professional incident response firms provide the specialized technical expertise that ransomware response requires and that generalist IT support cannot supply. For small businesses, the most immediately relevant capabilities are remote containment guidance, forensic evidence preservation, ransomware variant identification, backup integrity assessment, and threat elimination validation before restoration begins.
For small business incidents with limited environmental complexity, incident response firms can often complete the most critical work remotely without on-site presence. On-site response is more common for larger environments or incidents where physical access to systems is required for containment or evidence preservation.
The timeline from first contact to active remote support for firms with 24/7 emergency capability is typically one to two hours. On-site mobilization depends on the firm’s location and the business’s location, ranging from same-day to next-day arrival.
Costs for incident response engagements vary significantly based on environment size, incident complexity, and engagement duration. For small business incidents, costs range from a few thousand dollars for simple remote engagements to tens of thousands for complex incidents requiring extended on-site work. Cyber insurance coverage reduces or eliminates out-of-pocket cost for these engagements when the policy conditions are met.
What Your Managed IT Provider Can and Cannot Do
A managed IT provider with general IT management capability can assist with physical isolation actions, help identify which systems are affected, provide environmental documentation that supports the incident response team, and support the business continuity measures that keep partial operations running during recovery.
What a general managed IT provider typically cannot do is conduct a forensic investigation, perform malware analysis, execute threat elimination validation, or manage the regulatory compliance dimensions of the response. These functions require ransomware-specific expertise that general managed IT providers do not typically maintain.
If your managed IT provider has dedicated security operations capability and ransomware response experience, they may be able to provide a more complete response. Evaluate your provider’s specific capability against the incident response requirements before assuming they can manage the full response.
What to Expect From the Government Resources
CISA’s StopRansomware.gov portal provides guidance documents, ransomware variant information, and the option to report incidents for threat intelligence purposes. CISA does not provide direct incident response services to private small businesses but can connect organizations to available resources and provide threat intelligence that is relevant to active incidents.
The No More Ransom project at nomoreransom.org provides free decryption tools for specific ransomware variants. For small businesses without viable backups and without resources for a full recovery, finding a free decryption tool for their variant can be the difference between recovery and permanent data loss. Check this resource early in the response after the variant is identified.
What to Do Right Now If Ransomware Is Active
While making the emergency calls, your team can take the following actions immediately without specialized expertise.
Disconnect infected computers from the internet and network. Pull network cables from affected computers. Turn off Wi-Fi on affected devices if they are wireless. Do not unplug the computers from power. Keep them on but disconnected from the network.
Do not pay immediately. The payment decision requires backup assessment, variant identification, legal review, and insurance coordination. Making the payment before those steps are complete is making it with incomplete information under manufactured time pressure. The attacker’s deadline is designed to push you toward payment before you have assessed your options.
Do not wipe or reset affected computers. Evidence required for the investigation and potentially for decryption is present on affected systems and is destroyed by wiping or resetting. Keep systems powered on and disconnected from the network until professional guidance is received.
Write down what you know. Document what you observed, when you first noticed the problem, which computers are affected, what the ransom note says, and every action you have taken since discovery. This documentation supports the insurance claim, the forensic investigation, and the regulatory reporting that may be required.
Tell your employees what to do and what not to do. Employees need to stop using affected systems, not attempt fixes themselves, not connect personal devices to the network as workarounds, and not discuss the incident externally until legal guidance is received on communications. Communicate this through personal phones or in person if organizational systems are affected.
Activate any manual alternatives. If your business can continue any functions through paper processes, phone calls, or other manual methods, activate those now. Every revenue-generating function that can continue during recovery reduces the business interruption impact.
Common Small Business Mistakes in Ransomware Response
Understanding the mistakes that small businesses most commonly make during ransomware events allows your team to avoid them even without prior incident response experience.
Paying without assessing alternatives. Small businesses pay ransoms at higher rates than larger organizations because the operational pressure is more immediate and the awareness of alternative recovery paths is lower. Before paying, confirm whether backups are available, whether a free decryption tool exists for your variant, and whether the payment is legally permissible given the attacker group’s identity.
Engaging an IT person to clean infected computers without professional guidance. A general IT technician who wipes and rebuilds infected computers before forensic evidence is preserved destroys evidence that the investigation requires and may restore systems into an environment where the attacker maintains access, producing reinfection.
Delaying insurance notification to handle the technical response first. Every hour of delay in insurance notification is time during which covered costs are accumulating without confirmed coverage. The insurance notification is the first call, not a call made after the technical response is underway.
Communicating with customers about the incident before legal review. Statements made to customers during an active ransomware incident characterizing what happened, what data was affected, and what the business is doing carry legal implications. Premature communication that proves inaccurate creates additional exposure. Legal counsel must review all customer communication before it is sent.
Resuming operations on systems that have not been confirmed clean. Returning systems to operation before threat elimination is confirmed produces reinfection when the attacker uses maintained persistence to re-encrypt restored systems. The business pressure to restore operations quickly is real, but restoration before professional confirmation of threat elimination creates a worse outcome than the delay.
What Small Businesses Need Before an Incident
The resources that make ransomware response manageable for small businesses are most accessible and most effective when they are established before an incident requires them.
Cyber insurance with adequate limits and appropriate coverage. Review your current policy or obtain coverage if you do not have it. Confirm that the policy covers ransomware response costs, business interruption, and customer notification. Know your deductible and your coverage limits before an incident makes those numbers operationally relevant.
A managed IT provider with security capability. General IT support that does not include security monitoring, backup management, and incident response capability is insufficient for the ransomware threat environment. Evaluate your current provider’s specific security capability and supplement or replace it if the capability is inadequate.
Tested backups stored in an isolated location. Backups on the same network as your production systems are frequently encrypted alongside them. Backups in cloud storage with separate credentials, on external drives stored offline, or through a managed backup service that maintains isolated copies provide recovery options that on-network backups do not. Test these backups by restoring from them periodically. An untested backup is not a confirmed recovery option.
Emergency contacts stored outside your computer systems. The cyber insurance emergency line, the incident response firm contact, legal counsel contact, and your managed IT provider emergency line must be accessible when your computer systems are not. Print them. Store them physically in a location accessible to the people who will need them.
A basic incident response checklist. A one-page printed checklist that tells your team what to do in the first 30 minutes, who to call in what order, and what not to do is more useful during an active incident than a comprehensive plan stored in an affected system. The checklist should be physically accessible and should cover the actions described in this article.
Basic security controls that reduce ransomware risk. Multi-factor authentication on all accounts, current software updates across all systems, and employee awareness of phishing recognition are the foundational controls that reduce small business ransomware risk significantly.
Mindcore’s managed IT services help small businesses implement these foundational controls, maintain tested backup infrastructure, and establish the vendor relationships that make ransomware response manageable without requiring internal IT expertise.
Meet Our CEO, Matt Rosenthal
With more than 30 years of experience in business and technology leadership, Matt Rosenthal has helped small and mid-size businesses across healthcare, finance, legal, manufacturing, and defense navigate ransomware events and build the security foundations that reduce ransomware risk. As President and CEO of Mindcore Technologies, Matt leads a team that provides managed IT services and cybersecurity services specifically designed for organizations that need professional security capability without the cost of a full internal security team.
Matt’s approach to small business ransomware preparedness is grounded in the recognition that the gap between what small businesses typically have in place and what ransomware response requires is closeable with the right managed service relationships and the right foundational investments. The cost of those investments is consistently lower than the cost of a single unmanaged ransomware event.
Frequently Asked Questions
What if we cannot afford cyber insurance?
Cyber insurance for small businesses has become more accessible and more affordable than many small business owners assume, though pricing varies significantly by industry and security posture. Obtain quotes from multiple carriers and work with an insurance broker who specializes in cyber coverage. The monthly premium for a small business policy is typically a fraction of what a single ransomware event costs without coverage. If coverage is genuinely unaffordable, prioritize the security controls that reduce ransomware risk, specifically multi-factor authentication and tested backups, because reducing the probability of an incident is the alternative risk mitigation when insurance is unavailable.
Should we pay the ransom if we have no backups?
The payment decision requires specific analysis that cannot be reduced to a general recommendation. Before paying, confirm the variant does not have a free decryption tool through nomoreransom.org, screen the attacker group against the OFAC sanctions list through legal counsel because payment to a sanctioned group creates federal liability, confirm with your cyber insurance carrier whether the payment is covered and what conditions apply, and understand that payment provides a criminal organization’s promise without enforcement mechanism and does not guarantee recovery. With those factors assessed, payment may be the right decision in some situations where no alternative recovery path exists. It should never be the first decision made without that analysis.
How long will recovery take for a small business?
Small businesses with clean, recent backups and fast containment can often restore in one to three days. Small businesses without viable backups face longer timelines that depend on whether decryption tools are available, the extent of the encryption, and the complexity of the environment. The most honest answer is that recovery timeline cannot be accurately estimated until the backup assessment and scope assessment are complete. Estimates made before those assessments are speculation.
What if a family member or employee caused the incident by clicking a phishing link?
How the incident started does not change how it must be responded to. The response sequence, the external resource engagement, and the recovery process are the same regardless of the initial access vector. Avoid assigning blame during the active response, because it is operationally irrelevant and counterproductive to the coordinated response the incident requires. The post-incident review will identify how access was gained and what training or technical controls would have prevented it, which is the appropriate time and context for addressing the behavior that contributed to the incident.
Do we need to notify our customers?
Notification obligations depend on what data was on affected systems, which state or federal laws apply to that data, and what the forensic assessment determines about whether that data was accessed by the attacker. Legal counsel must advise on notification obligations based on the specific facts of your incident and the frameworks applicable to your industry and customer locations. Do not assume notification is not required because your business is small. Notification obligations apply based on the data involved, not the size of the organization holding it.
Get Help Now
If ransomware is active in your business right now, contact Mindcore immediately. The response support your business needs is available, and engagement speed directly affects recovery outcomes.
Mindcore’s managed IT services and cybersecurity services provide small businesses with the security infrastructure, backup management, and incident response capability that reduces ransomware risk and ensures that when an incident occurs, your business has the resources to respond effectively. If you want to build that capability before an incident makes it urgent, contact Mindcore to start that conversation today.
