When ransomware hits, it usually shows up early in the morning or over a weekend. Someone tries to log in and finds a ransom note instead of their files. Production stops. Customer records are out of reach.
The three scenarios below are illustrative. They are not accounts of specific NHM clients, and no real business is described. Each one is built on an attack pattern that is well documented in public reporting, and each shows a different way in and a different lesson.
Scenario 1: A Manufacturing Shop
A precision manufacturer with about 40 employees finds ransomware on a Monday morning. Every Windows machine shows a ransom note. CNC programs, customer specifications, the quoting database, and the accounting system are encrypted. Production stops.
How It Happened
An office employee clicked a link in an email that looked like it came from a large customer and typed their password into a fake login page. With those credentials the attackers got into the network, spent several days mapping it and disabling security tools, then struck over the weekend when nobody was watching.
The backups on the network-attached drive were encrypted along with everything else.
What Saved Them
A second backup copy was kept offline, where the attackers could not reach it. That is the difference between restoring and negotiating. Restoring every system, checking that files opened and matched, and getting the machines back on the floor would still take days, and the forensics, emergency IT work, and lost production would still cost real money. But there is no ransom and no reliance on a criminal's decryption tool.
What They Should Add Afterward
- Multi-factor authentication on email and all remote access
- Email filtering that checks links when they are clicked
- Network monitoring that would catch several days of reconnaissance
- Phishing awareness training and an easy way to report a suspicious email
- Endpoint detection and response that can stop encryption as it starts
Scenario 2: A Medical Practice
A specialty practice with three locations finds ransomware on its patient records and scheduling systems. Beyond the disruption, it now has to work out its HIPAA obligations to thousands of patients.
How It Happened
The attackers came in through a vendor's remote support tool. The vendor had been compromised, and its legitimate access was used to push ransomware to its customers. This is a real and recurring pattern: in 2021, attackers used a flaw in Kaseya's VSA remote management software to push ransomware through managed service providers to their downstream customers, as CISA and the FBI described at the time.
The practice had no control over the vendor's security and was still responsible for the consequences.
What Recovery Looks Like
Isolated backups let the practice restore without paying. The harder part is regulatory. HHS guidance on ransomware treats encryption of patient data by ransomware as a presumed breach unless the practice can show a low probability that the data was compromised. That means forensics to establish what was accessed, legal advice, and possibly notification letters.
What to Change
- Security review of any vendor before granting remote access
- Contract terms that require the vendor to secure that access and report incidents
- Network segmentation so one vendor connection cannot reach everything
- Regular restore testing
- Monitoring for unusual activity on vendor accounts
Scenario 3: An Accounting Firm
An accounting firm finds ransomware in the middle of tax season. Client files, returns, and working papers are encrypted, and deadlines do not move.
How It Happened
An employee took a call from someone claiming to be IT support and was talked into installing remote access software to "fix a problem." That gave the caller direct access to the workstation and, from there, to the network. The FBI's 2025 Internet Crime Report lists tech support scams among the largest sources of reported losses, and Verizon's 2026 report notes that pretexting like this has become a more common way into ransomware attacks.
No technical control failed. A person was tricked.
What Recovery Looks Like
Good offline backups mean no ransom. But restoring during the busiest weeks of the year means long hours, delayed client work, and clients asking whether their information was exposed. Some may leave.
What to Change
- Block unapproved remote access tools at the network and endpoint level
- Allow remote support only through approved, named channels
- Monitor for remote access software appearing on workstations
- A written rule that nobody installs software because of an incoming call, ever, without calling IT back on a known number
Common Patterns
How Attackers Get In
For small and medium-sized businesses in Verizon's 2026 Data Breach Investigations Report, the most common ways in were:
- Exploiting a vulnerability in an unpatched, internet-facing system (26% of breaches)
- Stolen credentials (13%)
- Phishing (9%)
A third party was involved in 55% of those breaches. Unpatched firewalls, VPNs, and remote access tools are not a side issue; across all organizations, exploiting a vulnerability has overtaken stolen credentials as the most common way in.
What Makes Recovery Possible
The factor that most determines how recovery goes is backup quality.
Businesses with isolated backups that attackers cannot reach can restore without paying. Recovery is still disruptive and expensive, but it is manageable.
Businesses without usable backups face bad choices: pay with no guarantee of getting everything back, or rebuild from scratch and lose data that may be irreplaceable.
What Makes Recovery Harder
- Backups that were never tested and turn out to be incomplete or corrupted
- No documentation of how systems were configured, so everything is rediscovered during the crisis
- No incident response plan, so hours are lost deciding what to do
- Key knowledge held in one person's head
The Costs People Undercount
- Employee stress and overtime during a long recovery
- Customer relationships that need repair
- More scrutiny from customers, partners, and regulators
- Cyber insurance renewals after a claim
- Leadership time spent on the crisis instead of the business
Prevention Is the Cheaper Side of the Ledger
In Verizon's 2026 data, the median ransom actually paid was $139,875, and 69% of victims refused to pay at all. Its 2026 Breach Impact Study found the worst breaches, the top 2.5%, cost small and mid-sized businesses more than 7% of their revenue. Those figures come before overtime, lost customers, and the months of follow-up.
Protection is a planned monthly cost. Our managed plans run $50-$100 per user per month, and the tiers are on our pricing page.
What Your Business Should Do Now
Fix Your Backups First
If you do nothing else, make sure you have a backup copy that ransomware cannot reach, and test restoring from it. Know how long a full recovery takes and plan around that number.
Patch What Faces the Internet
Firewalls, VPNs, remote desktop, and remote support tools get exploited first. Keep them updated, and keep a list of what you have so nothing is forgotten.
Turn On Multi-Factor Authentication
In a Microsoft study, MFA cut the risk of account compromise by more than 99%. Enable it everywhere you can, starting with email, remote access, and financial systems.
Train Your People
Verizon found a human element in 62% of breaches in its 2026 report. Regular training on phishing, phone scams, and suspicious requests makes employees part of your defense.
Know Your Vendors' Security
If vendors have access to your systems, their security becomes your problem. Assess it before granting access, and put security requirements in the contract.
Have a Plan
Know who you will call and what you will do if ransomware hits tomorrow. Write it down, review it periodically, and update it when things change.
How NHM Ohio Helps
We provide ransomware protection for businesses throughout Northeast Ohio:
Prevention
- Managed endpoint protection that detects and blocks ransomware
- Email security that filters phishing before it reaches employees
- Backups with offline copies and tested restores
- Security awareness training and phishing simulations
- Patching and monitoring for the systems that face the internet
Incident Response
When prevention fails, we:
- Contain the threat and stop it spreading
- Assess the damage and the recovery options
- Restore from backup without paying when that is possible
- Work out how the attackers got in
- Close the gaps so it does not happen the same way twice
Start Before You Need It
NHM Ohio helps businesses in Canton, Akron, Massillon, Alliance, and throughout Stark, Summit, and surrounding counties put ransomware protection in place before an incident. Contact us for a security assessment and we will tell you plainly where you stand.
NHM Ohio provides managed IT services, cybersecurity solutions, and incident response for businesses throughout Northeast Ohio. Visit nhmohio.com or call to discuss how we can help protect your business from ransomware.
