Ransomware: How North Carolina Small Businesses Prevent It and Recover

Some criminals skip the locking step and simply steal data, then threaten to release it (CISA #StopRansomware Guide). That matters for planning: a good backup gets your files back, but it does nothing about data that has already left the building.

Plain-English definitions of these terms, and of tools such as EDR and immutable backups, are in our IT and cybersecurity glossary.

Key takeaway: Ransomware is now two problems: getting your systems running again, and dealing with stolen data. Plan for both.

The FBI received more than 3,600 ransomware complaints in 2025 with losses of more than $32 million, and it warns that this loss figure does not normally include lost business, time, wages, files, equipment or outside recovery help (FBI IC3 2025 Internet Crime Report). So the real cost of these attacks is far higher than that reported figure.

Of the more than 1,400 ransomware complaints the FBI received in 2025 from outside critical infrastructure, the most came from legal services (18 percent), contractors such as electricians and general contractors (17 percent), engineering and architecture firms (10 percent), consultants (7 percent) and manufacturers of goods such as furniture and building materials (5 percent) (FBI IC3 2025 report).

For North Carolina numbers, including breach counts reported to the NC Department of Justice, see our North Carolina Small Business Cyber Risk Report 2026.

Patching is falling behind. Across all organizations in Verizon's data, only 26 percent of the most dangerous known flaws (those on CISA's Known Exploited Vulnerabilities list) were fully fixed in 2025, and the median time to fix one rose to 43 days (Verizon 2026 DBIR).

Third parties are a fourth door. More than half (55 percent) of small and midsize business breaches in Verizon's data involved a third party, such as a software vendor, a service provider or a partner with access to your systems (Verizon 2026 DBIR).

A real example: Akira, the ransomware variant reported most often to the FBI in 2025 (FBI IC3 2025 report), has gotten in through VPNs that did not have multi-factor authentication turned on, and through known software flaws (CISA advisory AA24-109A).

Key takeaway: Ransomware does not need a genius hacker. It often starts with a missed update, a stolen password or one rushed click.

The FBI's backup advice is specific: keep backups off-site or offline, make sure they are encrypted and immutable (they cannot be changed or deleted), cover all of your data, and keep up regular backup and restoration (FBI IC3 2025 report). CISA adds that you should regularly test that backups are available and intact in a disaster recovery scenario (CISA #StopRansomware Guide).

Our backup and recovery service is built around those rules, and our cybersecurity services cover monitored endpoint protection, multi-factor authentication and training. If you would rather start on paper, the free data backup and recovery policy and business continuity policy templates write the rules down for you. Because phishing often starts with email, our free email security checker shows whether your domain has basic email protections set up.

Key takeaway: If you can only fix one thing this month, turn on multi-factor authentication everywhere. If you can fix two, prove you can restore from a backup criminals cannot touch.

Write the plan before you need it. The free incident response plan template sets out who does what, who calls whom and where the phone numbers live. Then rehearse it with the tabletop exercise template.

• Find the affected machines and isolate them right away. That is the first response step in the CISA #StopRansomware Guide, which says to power devices down only if you cannot disconnect them.
• Do not turn machines off or delete anything until the experts arrive. The FTC says not to destroy forensic evidence and not to turn machines off until forensic experts get there (FTC data breach response guide). Take phone photos of the ransom note and any strange screens.
• Call your IT provider, then your cyber insurance claims line, then your attorney. CISA lists your cyber insurance company among the people to bring in (CISA #StopRansomware Guide).
• Report the attack to the FBI at ic3.gov and to CISA. The FBI asks for details such as the ransomware name if known, the ransom amount, and the payment address and email the criminals gave you.
• Talk to your attorney about whether personal information was taken, which can trigger North Carolina breach notice duties (see below).

Paying a criminal group that is under U.S. sanctions can break federal law even if you did not know who you were paying. OFAC applies "strict liability," meaning a company can be held civilly liable even if it did not know or have reason to know (OFAC advisory). OFAC says it will treat a prompt, complete report to law enforcement or CISA as a significant mitigating factor. That is one more reason to report early.

Fewer victims are paying. In Verizon's 2026 report, 69 percent of ransomware victims did not pay, and the median payment fell to $139,875 (Verizon 2026 DBIR). Coalition, a cyber insurer, says a record 86 percent of businesses in its 2025 claims data refused to pay (Coalition 2026 Cyber Claims Report).

North Carolina law bars State agencies and local governments, including school systems and community colleges, from paying or even communicating with ransomware criminals (N.C. Gen. Stat. 143-800). That law does not cover private businesses, but any decision to pay should involve your attorney, your insurer and law enforcement.

Key takeaway: The best way to avoid the payment question is a tested backup that lets you say no.

The definition matters. North Carolina's law covers unauthorized access to and acquisition of unencrypted and unredacted records containing personal information, where illegal use has occurred or is reasonably likely, or that creates a material risk of harm to a consumer (N.C. Gen. Stat. 75-61). Because many gangs steal data before locking it, expect your attorney to look at this question every time.

If you notify more than 1,000 people at one time, you must also notify the nationwide consumer reporting agencies (N.C. Gen. Stat. 75-65). Our plain-English guide to North Carolina data breach law covers who to notify, when and what the notice must say.

Insurance comes with rules of its own, such as how quickly you must report and which response firms you may use. Our cyber insurance guide explains what insurers ask, and the free cyber insurance readiness checker shows where you stand.