What actually happens during a ransomware attack — and how to survive one

Stage 1: Getting in

Most ransomware starts with something mundane — a phished password, a malicious email attachment, or an unpatched system exposed to the internet. The attacker rarely "breaks in" dramatically; they walk through a door that was left open. Defence: MFA, email security, patching and staff training close most of these doors.

Stage 2: Quietly spreading

Once inside, attackers often wait. They explore the network, steal credentials, escalate their access, and identify your most valuable data and your backups. This can take days or weeks, and traditional antivirus usually sees nothing. Defence: this is exactly what a Security Operations Centre exists to catch — the unusual behaviour during this quiet phase, before encryption begins.

Stage 3: Stealing data

Modern ransomware crews copy your data out before encrypting it, so they can threaten to publish it even if you have backups. This "double extortion" is now standard. Defence: monitoring for large data transfers, and controls that limit how much an attacker can reach.

Stage 4: Encryption and the ransom

Finally, the attacker triggers encryption — often overnight or over a weekend — locking your files and leaving a ransom demand. This is the moment you notice, and by then the earlier stages have already played out. Defence: immutable backups that the attacker could not delete mean you can recover without paying.

Stage 5: Recovery — the part that defines the outcome

Here is where preparation decides everything. A business with tested, immutable backups and an incident response plan contains the attack, restores from clean backups, and is running again — without paying a ransom. A business without them faces an impossible choice between paying criminals (with no guarantee) and losing their data. The attack is the same; the preparation is what differs.

How to make sure you survive one

Survival is built before the attack, not during it: layered prevention to reduce the chance of getting in, 24/7 monitoring to catch the quiet phase, immutable and tested backups via disaster recovery, and an incident response plan ready to go. Each stage above has a defence — together they turn a business-ending event into a bad few days.