Ransomware protection: a practical guide for South African businesses

Ransomware locks your files and demands payment to release them, and today’s attackers often steal your data first. Good ransomware protection is not about one product. It is a handful of basic controls done well, plus someone watching for the warning signs.

Book a free ransomware readiness check Call 021 001 0009

How ransomware attacks start

Most ransomware incidents begin in one of a few predictable ways:

Phishing emails that trick a user into opening a malicious attachment or entering their password
Stolen or weak passwords on email, VPN or remote desktop, especially without multi-factor authentication
Unpatched systems exposed to the internet, such as firewalls, VPN appliances and servers
Compromised suppliers or IT providers with access to your network

Attackers often spend days or weeks inside a network before they encrypt anything, looking for backups to delete and data to steal. That gap is your best chance to catch them.

Why ransomware is also a POPIA issue

Modern ransomware groups usually copy your data before encrypting it, then threaten to publish it. If that data includes personal information about customers or staff, you are likely dealing with a security compromise that must be reported under POPIA, as well as an operational crisis.

10 ransomware protection controls that stop most attacks

Turn on multi-factor authentication for email, Microsoft 365, VPN and all remote access
Never expose remote desktop (RDP) directly to the internet
Patch quickly, starting with firewalls, VPNs and other internet-facing systems
Run endpoint detection and response (EDR) on every computer and server
Follow the 3-2-1 backup rule, with at least one copy offline or immutable
Test that you can actually restore from backup, not just that backups ran
Give staff only the access they need, and use separate administrator accounts
Filter email for malicious attachments and links
Train staff to recognise phishing and to report anything suspicious
Monitor around the clock, so early signs of an attack are caught before encryption starts

What to do if you are hit

Disconnect affected machines from the network, but do not switch them off.
Call your IT provider or incident response team immediately.
Notify your cyber insurer early if you have a policy.
Do not contact the attackers or pay before getting expert and legal advice.
Work out whether personal information was accessed and follow the POPIA notification steps.

Our data breach response guide covers these steps in detail.

Should you pay the ransom?

Paying is a business and legal decision that should never be rushed. Payment does not guarantee you will get working decryption keys, does not guarantee stolen data will be deleted, and may mark you as a willing payer for future attacks. Law enforcement agencies generally advise against paying. The best position is to never have to decide, because your backups let you recover without the attackers.

Frequently asked questions

Can antivirus stop ransomware?

Traditional antivirus alone is not enough. Modern attacks often use legitimate tools and stolen passwords that antivirus does not flag. Endpoint detection and response, multi-factor authentication and 24/7 monitoring give much stronger protection.

Are backups enough to protect against ransomware?

Backups are essential, but attackers often try to delete or encrypt them first, and they may still leak stolen data. Keep at least one offline or immutable copy, test your restores, and combine backups with prevention and monitoring.

Are South African businesses targeted by ransomware?

Yes. South African organisations of all sizes, including government departments and well-known companies, have been hit by publicised ransomware attacks. Smaller businesses are targeted too, often because their defences are weaker.

Does cyber insurance cover ransomware?

Many policies cover some ransomware costs, but terms vary widely, and insurers increasingly require controls such as multi-factor authentication and offline backups before they will pay. Check your policy wording carefully.

How exposed is your business to ransomware?

Book a free ransomware readiness check and we’ll review your backups, remote access and monitoring against the controls above. Call 021 001 0009 or email sales@acorntelecoms.co.za.

Book a free ransomware readiness check