Ransomware Attack on a Small Business: Anatomy, Step by Step

Monday, 7:15 a.m. The office manager of a 35-person HVAC contractor in Montréal's West Island boots up her computer and finds a text file on the desktop titled "README_RESTORE". The dispatch software won't open. The shared drive is full of files with a strange extension. Technicians are already calling: they can't see their service calls for the day.

This scenario is fictional, but every step in it follows well-documented attack patterns. Ransomware almost never strikes out of nowhere. By the time files are encrypted, attackers have usually been inside the network for days, sometimes weeks.

That's actually good news. A long attack chain means many chances to break it. Here is how a typical ransomware attack on a small business unfolds, and what would have stopped it at each stage.

The setting: a typical small-business network

Our contractor runs a Windows file server, a cloud-based accounting package, a network-attached storage (NAS) device for backups and a VPN so the office staff can work from home. An outside IT provider drops by once a month. The controller holds the "admin" password.

Nothing about this is unusual, which is exactly the point. Ransomware groups don't need to pick you out. They buy and scan for open doors at scale, then go through whichever ones they find.

The six stages of a ransomware attack

1. Initial access

A project coordinator left the company eight months ago. Her VPN account was never disabled. She had reused that password on a fitness app that was later breached, and the credentials ended up in a list sold on a criminal forum.

The VPN only asks for a username and password. The buyer logs in as her. Other common entry points listed by the Canadian Centre for Cyber Security include phishing emails, Remote Desktop (RDP) exposed to the internet, brute-forced passwords and unpatched software vulnerabilities.

2. Reconnaissance

Once inside, the attacker takes their time. Using built-in Windows tools, they map the environment: which servers exist, who the administrators are, where backups live, which folders hold the valuable data. To a traditional antivirus, this looks like normal IT work.

3. Privilege escalation

A former employee's account doesn't open every door, so the attacker looks for better keys: an admin password saved in a script, a service account nobody has changed in years, or the controller checking email while logged in as a domain administrator. Within days, they own the network.

4. Disabling defences and backups

This is the stage that turns a bad week into a disaster. The attacker turns off security software where possible, deletes Windows shadow copies, then logs in to the NAS. It is joined to the domain and uses the same admin credentials, so the backups are wiped first.

5. Data exfiltration

Before encrypting anything, the attacker copies what will hurt most: customer lists, payroll, employee files, contracts. The data is uploaded to a cloud storage service. This is "double extortion": pay once to decrypt your files, and again to keep them off a leak site.

6. Encryption and ransom demand

Encryption is usually timed for a Friday night or a long weekend, when nobody is watching. Servers and laptops are encrypted within hours. On Monday, the ransom note is waiting, with a link to a "support" portal and a countdown timer.

Where the chain could have been broken

Each stage leaves traces and offers a chance to intervene. Here is what would have changed the outcome in our scenario.

Notice that no row says "buy a better antivirus." Good defence is layered: when one control fails, the next one catches the attacker.

Why detection time matters so much

The attacker needs time between getting in and pulling the trigger. The sooner you spot them, the less they can steal or destroy. According to CDW, small Canadian organizations took an average of 6.8 days to detect an incident in 2025, up from 4.0 days in 2024.

A week is more than enough to go from stage 1 to stage 6. The bill follows: according to industry data cited by Insurance Business Canada (October 2025), a ransomware incident costs $330,000 on average. For a 35-person company, that can wipe out years of IT budget.

You don't need an in-house security operations centre to close that gap. A managed EDR service, where someone actually reviews alerts at night and on weekends, covers a large part of it.

The first hours, if it happens to you

Nobody likes planning for this, but a few reflexes, in line with the Cyber Centre's ransomware playbook, make a real difference:

1. Isolate affected devices from the network and the internet, and shut down remote access such as the VPN.
2. Switch to a separate channel. If your email is compromised, the attacker may be reading your messages.
3. Call your insurer before hiring anyone. Many policies require you to use their response firms. It is also a good moment to revisit what your cyber insurance questionnaire said about your controls.
4. Preserve evidence. Don't rush to wipe and reinstall; logs will show how far the attacker got.
5. Report it to your local police, the Canadian Anti-Fraud Centre and the Canadian Centre for Cyber Security.

If personal information was accessed or stolen, privacy obligations apply. In Quebec, Law 25 requires you to record the incident and, where there is a risk of serious injury, notify the Commission d'accès à l'information and affected individuals. Confirm the details with your legal counsel. All of this is far easier to work out calmly in an incident response plan than in a Monday-morning panic.

Checklist: break the chain before it starts

• MFA on VPN, email and every admin account (see how to choose the right MFA)
• Departing employees' accounts disabled on their last day
• No Remote Desktop exposed directly to the internet
• Firewalls, VPNs and internet-facing servers patched promptly
• Admin accounts separate from everyday accounts
• EDR on every laptop and server, with someone reviewing alerts
• At least one offline or immutable backup with separate credentials (see the 3-2-1-1-0 backup rule)
• A full restore tested at least once a quarter

Can't tick half of these boxes? Plenty of small businesses have never been through the exercise. Our remediation and hardening services are designed to close these doors in the right order, starting with initial access and backups.

The bottom line

Ransomware isn't bad luck. It is the end result of a series of steps, each of which could have been blocked. The earlier the chain breaks, the smaller the bill.

Start with the two links that decide everything: the front door, and a backup copy the attacker can't reach. They are the difference between a rough Monday and several weeks of downtime.