Ransomware

Ransomware is malicious software that locks or encrypts your files and demands payment to unlock them. Many attackers also steal data first and threaten to publish it. Construction firms, contractors and small businesses are frequent targets because they often have weak defenses and can’t afford downtime.

• Small businesses
• Contractors
• Home users

How it gets in

• Phishing emails with malicious attachments or links. See Phishing
• Stolen or reused passwords, especially for remote access tools
• Unpatched software and old, unsupported systems. See Software Updates
• Fake software downloads and pirated programs

What it can do to a contractor

• Lock up estimates, bids, drawings, schedules and payroll
• Delay projects and payments, and trigger contract penalties
• Expose employees’ and customers’ personal information

Prevention

• Back up important files regularly, with at least one copy offline or that can’t be changed. See Backups
• Test that you can actually restore from backups
• Turn on two-factor authentication for email and remote access. See Two-Factor Authentication
• Keep every computer, server and router updated
• Give staff only the access they need; limit administrator accounts
• Train everyone to spot and report phishing
• Have a written plan for who to call if it happens

If you’re hit

1. Disconnect affected computers from the network (unplug the cable, turn off Wi-Fi) to stop the spread. Don’t turn them off unless instructed; evidence may be lost.
2. Call for help: your IT provider, your cyber insurance company if you have one, and the FBI (ic3.gov or your local field office).
3. Don’t pay without advice. The FBI discourages paying: it funds criminals and doesn’t guarantee your files back. Paying may also raise legal issues.
4. Restore from clean backups after the infection is removed.
5. Change passwords from a clean device.
6. Consider whether you must notify employees, customers or regulators if personal data was exposed.

Last updated: October 2, 2026