10 Signs You’ve Been Hit by Ransomware

10 Signs You’ve Been Hit by Ransomware – and What to Do Next

Ransomware is one of the fastest-growing threats to small and medium-sized businesses in the UK. It’s disruptive, costly, and often devastating to business continuity. Worse still, many businesses don’t realise they’ve been hit until it’s too late. That’s why spotting the signs early and knowing exactly how to respond is so important.

Here are ten common warning signs that could mean your business has been targeted by ransomware, followed by practical steps to take if any of them sound familiar.

  1. You notice strange file extensions or encrypted files
    If your files suddenly have odd extensions like .locked, .crypt, or become unreadable, this is one of the most immediate red flags of ransomware encryption.

  2. A ransom message appears on your screen
    Seeing a message demanding payment—often in cryptocurrency—in exchange for access to your data indicates your systems have been compromised.

  3. Your backups are missing or inaccessible
    Ransomware often targets backup systems first. If you’re unable to access recent backups or they’ve mysteriously disappeared, it could be part of the attack.

  4. Systems start running unusually slowly
    Ransomware consumes system resources while encrypting data, so if your devices or network slow to a crawl, it may not just be a technical glitch.

  5. You get alerts from your antivirus or security tools
    Modern security software often flags suspicious file changes or administrative activity. These alerts can be early warning signs—don’t ignore them.

  6. Staff report suspicious emails or pop-ups
    If team members mention odd messages, pop-ups or files they don’t recognise, it may be a phishing attempt or part of an active attack already underway.

  7. Several devices or servers go offline at once
    If multiple machines become unresponsive or inaccessible simultaneously, ransomware may have spread across your network.

  8. External drives or shared folders are infected
    Can’t open mapped network drives or shared folders? Ransomware frequently spreads to connected storage locations to maximise damage.

  9. Unusual outbound network traffic
    A spike in network activity—especially outgoing data—can signal ransomware sending your data elsewhere before encryption begins.

  10. You’re locked out of critical apps
    Losing access to key systems or receiving repeated login errors may not be an accident. It could indicate that systems have already been compromised.

So, what should you do next?

First, don’t panic—but act quickly. If you suspect ransomware, isolate affected machines by disconnecting them from the network immediately. Avoid shutting down unless advised, as this can complicate recovery efforts. If you have clean, recent backups, now is the time to restore them. Make sure they’re not connected to the infected network.

Contact your IT support team straight away. If you don’t have one, a provider like Better-IT can help. Our team can help contain the attack, recover your systems, and assess how it happened. We also assist with reporting the incident to relevant authorities, which is a legal obligation in some cases—especially if personal data has been compromised.

Going forward, prevention is key. Ensure your business has regular, tested, and secure off-site backups. Implement multi-factor authentication across all logins. Train your team to spot phishing attempts and ensure all software is current. Cyber Essentials Plus and ISO 27001 frameworks can help protect against these threats, and Better-IT can guide you through both.

If you want to see what this looks like in practice, read this case study from one of our clients who moved away from Better-IT in search of Mac specialists. They quickly realised what they’d lost when the personal support was gone, and returned to us when things went wrong. You can read their full story here: Reclaiming Reliable IT Support

Ransomware isn’t going away. But with the right support, preparation, and response plan, your business doesn’t have to be the end of the world. If you’re unsure where your vulnerabilities are—or want to check your backup strategy—get in touch. We’re happy to review it with you.

Better-IT helps UK businesses stay resilient, protected, and in control—even when cyber threats strike. Let’s talk.