It happens to small offices, not just big companies
The morning starts like any other. Then the billing program will not open, every file on the PC has a strange new extension, and a text file on the desktop asks for payment in Bitcoin to "unlock" your data.
Ransomware attacks on small Indian businesses are common because they work: one PC, one shared folder, no IT team, and years of accounts in a single place. The attacker does not need to know who you are. A fake invoice in an email, a cracked software download or an old remote-desktop password is enough.
This guide covers what to do in the first hour, how to get your data back, and how to set up backups so the next attack is an inconvenience, not a disaster.
The first hour: what to do, and what not to do
Do this straight away:
- Pull the network cable and turn off Wi-Fi on the affected PC. Ransomware spreads to every shared folder and drive it can reach. Do not shut the PC down yet if you can avoid it; some recovery work needs it as it is.
- Check the other PCs and the server. If they share folders with the affected PC, disconnect them too until you know they are clean.
- Unplug any USB backup drive that is still attached, and do not plug it into any PC on the network until the problem is fixed.
- Take photos of the ransom note and the error screens. You will need them for the police complaint and for your IT person.
- Report it at cybercrime.gov.in or call the national helpline 1930. The complaint is also useful if you claim on cyber insurance.
Do not do this:
- Do not pay first and think later. Paying does not guarantee a working key, it marks you as a business that pays, and the money may come back to attack you again.
- Do not restore your backup onto the same infected PC. If the ransomware is still running, it locks the restored files too. Clean or reinstall the PC first.
- Do not try random "decryptor" downloads from unknown sites. Some are more malware.
Why the backup is usually locked too
Most offices that lose data to ransomware did have a backup. It just was not safe from the attack:
- The USB drive was plugged in. Ransomware locks every drive letter it can see. A backup drive that stays connected is just another drive.
- The backup was on a shared folder or a second PC. If you can open it from the office network, so can the ransomware.
- The cloud folder synced the damage. Google Drive, OneDrive and Dropbox copy changes as they happen. When your files are encrypted, the encrypted versions are uploaded too. Version history can help, but restoring thousands of files one by one is slow, and the history is limited.
- The only copy was last night's. Many attacks sit quietly for days before locking anything. If your backup keeps only the latest copy, that copy may already be damaged.
The rule is simple: a backup that anyone at your PC can change or delete, a virus can change or delete too.
How to get your data back
If you have a clean backup, recovery is a planned job, not a panic:
- Clean the PC first. Have your IT person remove the ransomware or, safer, reinstall Windows. Change every password used on that PC, including email, banking and remote-desktop logins.
- Pick the right copy. Find out roughly when the attack began. Choose a copy from before that date, not simply the newest one.
- Restore the databases beside the live ones. For SQL Server databases, restore under a new name first, open it, and check that the latest bill or voucher you expect is there. Only then switch over. Our SQL Server Express backup guide shows how to restore a copy under a new name.
- Restore your accounting folders. For Tally, Busy or Marg, restore the whole data folder from a copy taken before the attack, then open each company and check the last entries. See how to back up Tally data automatically.
- Re-enter the gap. Anything entered between the backup and the attack has to be typed again from bills, challans and bank statements. This is why a daily backup matters: the gap is one day, not one month.
If you have no clean backup, the options are poor: a free decryptor for that ransomware family (the No More Ransom project lists them), a data-recovery specialist, or paying. None of them is reliable. The time to fix this is before it happens.
What a ransomware-safe backup looks like
Four things make the difference:
- Off the premises. A copy outside your office survives theft, fire and anything that spreads across your network.
- Locked against change. The stored copies cannot be changed or deleted from your PC, even by someone with your password, for a fixed number of days. Storage services call this "object lock" or "immutable" backup.
- Several earlier copies. Daily copies for the last two weeks, then weekly and monthly ones, so you can step back to before the attack started.
- Tested. A backup that has never been restored is a hope, not a backup. Test a real restore at least once a month.
How JS1 Vault protects you
JS1 Vault is built around exactly this:
- Every evening it backs up your SQL Server databases (JS1 ERP and other software, on any edition including Express) and your folders and files, including Tally, Busy and Marg data. Everything is encrypted on your PC before it leaves.
- Copies are stored in India, away from your office.
- Every database copy is locked for 14 days, so nothing on your PC, not even ransomware, can change or delete it. After that we keep one copy a week to 8 weeks and one a month as far back as your plan allows. For folders, earlier versions of changed files are kept too.
- Once a month a database copy is restored on your PC under a new name and opened, to prove it really comes back.
- An email every evening tells you all is safe, or tells you and us at once when a backup did not happen.
- When you need a database back, a JS1 technician restores it beside your live data, never over it.
You can try it free for 30 days on one PC, with no payment.
See how JS1 Vault works and start a free trial.
← Back to all posts