Ransomware in 2026: What a Real Attack Looks Like for a Mid-Sized Business

The fictional company: Meridian Building Services

Meridian is mid-sized in every meaningful sense. Not large enough to have a dedicated security operations centre. Not small enough that an incident would simply shut everything down cleanly. The IT manager, Paul, knows the environment well but works primarily in reactive mode: help desk tickets, hardware replacements, Microsoft 365 administration. There is no formal incident-response plan.

This profile is not a worst-case description. It reflects a common configuration for UK and North American mid-market businesses in 2026.

What modern ransomware actually does

Most descriptions of ransomware stop at encryption: an attacker encrypts your files and demands payment for the decryption key. That description was largely accurate in 2017. It understates what current ransomware incidents typically involve.

Modern ransomware attacks are often multi-stage intrusions that combine credential theft, network reconnaissance, privilege escalation, data exfiltration, and only then, encryption. The encryption event that employees notice is frequently the final act of an operation that has been running for days, sometimes weeks.

The stages, described in defensive terms:

Initial access. Attackers get their first foothold in the environment. The Sophos Active Adversary Report 2024 found exploited external vulnerabilities were the leading initial access vector (32%), followed by compromised credentials (29%), and phishing (21%). Many of these entry points are not zero-day exploits. They are unpatched systems, reused passwords, and exposed remote desktop services.

Persistence and reconnaissance. Once inside, attackers establish persistence so they survive detection or reboots, then map the environment: what systems exist, what data is accessible, where backups are stored, which accounts have elevated privileges.

Privilege escalation and lateral movement. Attackers seek accounts with broader access, particularly domain administrator privileges. From one compromised endpoint, they may move to dozens of systems. This is the stage where attackers reach file servers, backup systems, and the ERP database that contains the company's most sensitive data.

Data exfiltration. Before encryption, many ransomware operators copy sensitive data to attacker-controlled infrastructure. This creates the basis for double extortion: the company faces both a ransom demand to recover access to encrypted systems and a separate threat to publish or sell the stolen data if payment isn't made.

Encryption and disruption. The final stage is the visible event: files are encrypted, systems become inaccessible, and ransom notes appear across the environment.

The incident timeline: what happens at Meridian

The following timeline reflects how ransomware incidents have been documented to unfold, based on published incident-response research from Mandiant, Sophos, CrowdStrike, Secureworks, and CISA. It is an illustrative scenario, not a report of an actual incident.

Day 1: the business starts breaking

By 10 AM on Day 0, Meridian's employees understand that something is wrong. By noon, most of them cannot do their jobs. Here is what each function experiences. The precise impacts will differ between organisations depending on architecture, systems, and what is affected.

Email (Microsoft 365) and the SaaS CRM remain available because they are cloud-hosted and not connected to the on-premises environment. This is one of the few things working in Meridian's favour. For companies where core operations run entirely on-premises, the disruption would be more complete.

The executive crisis meeting

At 2 PM on Day 0, the CEO, COO, Head of Finance, IT manager, legal counsel, and the external incident-response lead sit together. This meeting is where ransomware becomes visibly a business problem rather than a technology one. The questions facing the room are not technical.

What systems are encrypted and which are clean? How long until basic operations can resume? Has customer data been compromised? What are the legal obligations if data has been stolen? Does the cyber-insurance policy require specific actions before recovery begins? Should law enforcement be contacted? What do employees need to be told, and when? Who authorises the communications? Who is speaking to the ransom demand?

These questions cannot be answered quickly by an IT manager working alone. Many of them require decisions that sit at the CEO and board level. And many of them need to be answered before recovery work can begin, not after.

The backup test: the moment that changes everything

There is a moment in almost every ransomware incident that determines the trajectory of recovery. It is the moment when someone checks whether the backups are actually usable.

Meridian had backups. The IT manager had been running nightly backups to a NAS device and had started some cloud backups earlier that year. The discovery:

The on-premises NAS was connected to the same network the attacker traversed. It is encrypted. Fourteen months of on-premises backups are gone. The cloud backups are intact, but they cover only certain systems, not the ERP. The ERP backup that does exist is 11 days old. That gap means 11 days of transactional data, invoices, work orders, and records are gone.

The distinction that matters: having backups and having recoverable backups are not the same thing. A backup that was never tested, stored on an accessible network, or not updated to include newer systems provides false confidence rather than genuine resilience.

Data theft and extortion

By Day 2, the forensic team has identified evidence that several gigabytes of data left the environment before encryption. This is the part that changes the legal and regulatory picture significantly.

The encrypted files might be recoverable from backups, imperfectly. But the data that was copied to an attacker's server cannot be un-copied. The company now faces a second threat: the attackers' claim that they will publish the stolen data unless paid separately, regardless of whether the encryption ransom is paid.

What data was taken matters enormously. If the stolen data includes employee information, the company has data protection obligations. If it includes customer account details or personally identifiable information, affected individuals may need to be notified under GDPR in the UK and Europe, state data breach notification laws in the US, or equivalent regulations in other jurisdictions. Notification timelines vary: GDPR requires notification to the relevant supervisory authority within 72 hours of becoming aware of a personal data breach if it poses a risk to individuals.

None of this is resolved by paying the ransom. Paying does not guarantee data deletion. Multiple documented incidents have shown that companies which paid received no confirmation of data destruction and later saw stolen data published regardless.

Should the company pay the ransom?

Meridian's leadership now faces a demand for $850,000. No one can give them a simple answer. The decision involves factors that vary by organisation and incident.

Factors pushing toward considering payment: The backup situation is worse than expected. The ERP restoration will take at least two weeks. The company has cyber-insurance with a ransomware provision. The business interruption is already significant and every additional day without the ERP costs money. The attackers have data they are threatening to publish.

Factors pushing against payment: FBI and CISA guidance consistently advises against paying ransoms because payments fund criminal operations and do not guarantee file recovery or data deletion. Paying does not remove the attacker from the network if persistence mechanisms remain. Some ransomware groups do not reliably provide working decryption keys. Paying may create future targeting risk. Depending on the attacker group, sanctions may make payment legally prohibited. Sophos 2025 data found 80% of organisations that paid were attacked again within 12 months (Fortinet 2025 data).

The Sophos State of Ransomware 2025 report found that 46% of affected organisations paid a ransom, making it the second-highest rate in six years. Of those that paid, 53% paid less than the initial demand through negotiation. This is a real, documented decision that many organisations make. The framing "never pay" understates how difficult the decision actually is in practice.

Week 1: containment and recovery

Before any recovery work begins, the incident-response team needs to answer a critical question: has the attacker's access been fully removed from the environment? Restoring systems into a compromised network can result in re-infection within hours. Many documented incidents have involved organisations that restored from backup and were re-encrypted because persistence mechanisms remained in place.

The first week of response at Meridian involves parallel workstreams:

Investigation: Forensic analysis of compromised systems, identification of the initial access vector (confirmed as a compromised VPN credential), mapping of attacker movement through the environment, determination of what data was accessed or exfiltrated, and preservation of evidence for potential law-enforcement or legal purposes.

Containment: Full credential reset across the environment, disabling or removing persistence mechanisms identified by forensics, network segmentation to isolate clean systems, rebuilding the most critical servers from trusted sources.

Recovery sequencing: Systems are brought back in priority order. Identity infrastructure comes first (Active Directory or equivalent), then core network services, then critical business applications, then data recovery from clean backups, then employee endpoints. This process typically takes days to weeks, not hours.

The business runs in manual mode. Finance teams work from printed records and email. Operations staff coordinate by phone. Customer commitments are managed case by case. This is operationally exhausting and directly impacts revenue.

The hidden cost of ransomware

The ransom demand is the number that makes the news. It is rarely the largest cost.

For context: the Sophos State of Ransomware 2025 global survey of 3,400 organisations found a mean recovery cost of $1.53 million globally excluding the ransom payment itself. For US organisations specifically, the US-edition report found the mean recovery cost was $1.91 million, also excluding ransom. These figures are global survey means and include organisations of various sizes, not specifically mid-market companies, so direct comparison to a specific scenario requires caution.

What would have changed the outcome?

Return to Meridian. Not every control prevents every attack. But several specific gaps directly worsened the outcome.

Multi-factor authentication on the VPN. The initial access was a compromised credential. If the VPN required MFA, a stolen password alone would not have been sufficient for access. This is consistently among the highest-ROI security controls for this attack pattern. CISA's guidance on ransomware prevention identifies MFA as a primary preventive control.

Endpoint Detection and Response (EDR). Standard antivirus did not alert on the attacker's activity during the pre-encryption phase. An EDR solution with behavioural detection would have had a higher probability of flagging the lateral movement, credential access, and staging activity before encryption began. The Sophos State of Ransomware 2025 found that 44% of organisations were able to stop the attack before data was encrypted, a six-year high, partly attributed to improved detection tools including MDR and EDR adoption.

Isolated and tested backups. The on-premises backup server was on the same network as the rest of the environment and was encrypted along with everything else. Offline, air-gapped, or cloud backups with immutable retention would have preserved recovery options that were lost in this incident.

Privileged access controls. The attacker reached domain administrator level and was therefore able to access everything. Limiting which accounts have administrative privileges and requiring separate credential sets for administrative tasks (a principle called least privilege) would have constrained the attacker's reach.

An incident-response plan. The first several hours of the Meridian response were consumed by decisions that could have been pre-made: who leads the response, who is contacted, what gets isolated first, who talks to the insurance company, who handles communications. None of those decisions require an emergency meeting to resolve if they were documented in advance.

When managed cybersecurity services make sense

Meridian has three IT staff. None of them are security specialists. They are not watching security logs at 3 AM when the encryption begins. They are not running threat hunts through the environment looking for pre-encryption attacker activity. For a company of this size, building that capability internally is typically not cost-effective.

Managed Detection and Response (MDR) is a category of outsourced security service that provides 24/7 monitoring, threat hunting, alert investigation, and active incident response by security analysts. MDR providers maintain security operations centres, employ specialist threat hunters, and have response capabilities that most mid-sized businesses cannot build internally.

A key distinction from traditional managed security services: MDR providers typically take active response actions, not just alert escalation. When a threat is confirmed, an MDR provider can isolate an endpoint, block a malicious process, or contain a compromised account, not simply send an email telling the IT team an alert fired.

Managed services make the most sense when an organisation lacks 24/7 security monitoring, does not have the internal expertise to investigate security alerts or perform threat hunting, has experienced incidents or near-misses that indicate a detection gap, or operates in a regulated industry where security controls need to be verified against a standard.

Managed services are not a guarantee against ransomware. No single control prevents all incidents. But faster detection materially reduces the impact: IBM's 2025 Cost of a Data Breach research found that organisations with high levels of security AI and automation detected breaches 100 days faster and saved an average of $2.2 million in breach costs compared to organisations without that capability.

Cybersecurity and managed services companies to consider

The following companies are established providers of managed detection and response and related cybersecurity services, relevant to mid-sized businesses in 2026. This is not a ranked list or a paid placement. All capabilities are verified from official company documentation as of mid-2026. Pricing is custom and quote-based for all listed providers.

How to choose a managed cybersecurity provider

• Is monitoring genuinely 24/7 with human analysts, or is it alert-forwarding during business hours?
• When a confirmed threat is identified at 3 AM, what response actions can the provider take without waiting for your approval?
• Is incident response included in the base contract, or is it a separate retainer with additional cost?
• Which endpoint, cloud, identity, and network platforms does the provider natively support, and how well does it integrate with your existing stack?
• What is the mean time to respond to a confirmed threat, and is this a contractual SLA or a marketing figure?
• Does the provider support your compliance requirements (SOC 2, ISO 27001, HIPAA, PCI DSS, GDPR) and can they provide evidence of monitoring for audit purposes?
• If ransomware is detected mid-deployment, what is the specific response sequence, which actions does the provider take, which require your authorisation?
• Are there per-endpoint or per-GB ingestion charges beyond the base price that could make the service significantly more expensive at scale?
• Can the provider demonstrate references from organisations of similar size and sector?
• What does the onboarding and coverage tuning process look like, and how long until the service is operating with full context of your environment?

What CEOs, CFOs, and COOs should know

Ransomware is an operational continuity risk, not an IT problem. The following points are what every non-technical executive needs to understand before an incident occurs.

The companies that recover fastest from ransomware are not necessarily the ones that spent the most on security. They are the ones that prepared for failure before it happened: tested backups, MFA enforced, an incident-response plan that was actually used in a tabletop exercise, and an external response relationship already established before it was urgently needed.

For verified managed cybersecurity agencies and IT security providers across the categories covered in this article, TechRadiant's verified IT managed services index covers providers evaluated on documented delivery outcomes. For the broader IT resilience picture that ransomware connects to, see TechRadiant's guide to business continuity planning and IT resilience audits in 2026.