When ransomware hits a business, the ransom demand gets the headlines. The bigger bill is usually downtime: days or weeks when you can't run jobs, ship orders, see patients, bill customers or pay employees on time.
Ransomware is not slowing down. In its 2025 Internet Crime Report, the FBI received more than 3,600 ransomware complaints, and the most common ransomware variants hit critical manufacturing and healthcare among the hardest. The FBI also notes that many victims never report losses, so the true cost is far higher than the reported figures.
The good news is that most of what shortens an outage is decided long before an attack: how attackers get in, whether your backups survive, and whether your team knows what to do in the first hour.
What a week of downtime really costs
Before you can decide how much protection makes sense, it helps to put a number on an outage. A rough estimate takes five minutes:
- Lost revenue. Average daily revenue that stops or slips when systems are down.
- Idle payroll. Wages for employees who can't work, or who work slowly on paper.
- Recovery costs. Outside IT and forensic help, overtime, and replacement equipment.
- Penalties and promises. Late fees, missed contract deadlines, and work you have to redo.
- Customer trust. Customers who go elsewhere while you're offline, and the cost of notifying people if data was stolen.
Multiply the daily total by a realistic recovery time. Restoring from good, tested backups might take a day or two. Rebuilding without them can take weeks. For most businesses, that gap is far larger than the cost of preventing it.
How ransomware gets in
Ransomware rarely arrives out of nowhere. Federal advisories on ransomware groups describe the same few entry points again and again:
- Phishing emails that install malware or steal a password.
- Stolen or guessed passwords on accounts without multi-factor authentication (MFA), especially email and remote access.
- Unpatched internet-facing systems, such as VPNs, firewalls and remote access tools with known vulnerabilities.
- Exposed remote desktop connections left open to the internet.
Once inside, attackers typically look for administrator access, find and delete or encrypt your backups, steal sensitive data, and then encrypt everything they can reach. That is why the backups you can reach from your normal network are often the first casualty.
Simple steps that prevent ransomware and shorten recovery
- Turn on multi-factor authentication everywhere it matters. Start with email, remote access and administrator accounts. CISA recommends phishing-resistant MFA wherever possible.
- Patch internet-facing systems first. Firewalls, VPNs and remote access tools are favorite targets. Apply security updates quickly and replace devices that no longer receive them.
- Keep backups attackers can't reach. CISA's ransomware guidance calls for offline, encrypted backups of critical data. Use backups that are offline or immutable (they can't be changed or deleted for a set period), and protect backup admin accounts with their own credentials and MFA.
- Test restores, not just backups. A backup job that "succeeds" every night is not proof you can recover. Restore real files and full systems on a schedule, and time how long it takes.
- Watch your devices around the clock. Endpoint detection and response (EDR) with 24/7 monitoring can spot and stop ransomware behavior early, often before encryption spreads.
- Limit administrator access. Give staff everyday accounts without admin rights, and keep admin accounts separate and few. Fewer powerful accounts means fewer ways for an attacker to take over the network.
- Separate what matters most. Segment your network so one infected laptop can't reach servers, backups and production systems.
- Write a one-page incident plan. Include who to call (IT provider, cyber insurer, attorney, bank, FBI), how to isolate systems, and how the business keeps running on paper for a few days. Walk through it once a year.
- Don't plan on paying. The FBI does not support paying a ransom. Payment doesn't guarantee your files come back, and it doesn't stop stolen data from being leaked. Your backups and your plan are your real recovery options.
If you're hit
Disconnect affected devices from the network, but don't power them off or wipe them; evidence matters. Call your IT provider and your cyber insurer before you do anything else, since many policies require you to use approved responders. Report the attack to the FBI at ic3.gov or your local FBI field office. If personal information may have been stolen, Texas law sets deadlines for notifying people; our Texas data breach response guide explains them.
Where to start
If you do only three things, turn on MFA for email and remote access, confirm you have an offline or immutable backup, and test restoring something important this month. Our ransomware readiness guide goes deeper, and our business continuity and disaster recovery service covers backup, recovery and planning.
HUFF DATA SYSTEMS helps Texas businesses reduce ransomware risk and recover faster. If you would like to know how long your business would be down today, talk with our team.
Sources
- 2025 IC3 Annual Report, FBI Internet Crime Complaint Center
- Ransomware, FBI
- #StopRansomware Guide, CISA
- StopRansomware, CISA
- #StopRansomware: Akira Ransomware, CISA, FBI and partners