Many small business owners still think ransomware attacks only happen to hospitals, global brands, or public infrastructure. In reality, ransomware small business risk is one of the clearest examples of how attackers are consistently targeting organizations with valuable data, limited time, and weaker defenses.

Proton 数据泄露观测站的最新发现显示，中小企业经常成为数据违反的受害者。在最严重的破坏性事件中，中小企业所占比例也过高，包括涉及高风险数据和大量记录泄露的违反事件。

勒索软件是一个涉及业务连续性、凭证安全和数据保护的问题。英国政府的《网络安全违反调查》发现，1% 的英国企业在过去 12 个月内确认了勒索软件事件，高于 2024 年的不足 0.5%。按全国规模计算，这相当于约 19,000 家企业。

Despite the rise of ransomware, phishing is still the most common type of cyberattack. Attackers most frequently get access to business networks through people, credentials, and routine workflows rather than through large-scale cyberattacks. They can essentially use a phishing attack to then launch a larger ransomware attack if they sense a greater payday.

对小型企业而言，勒索软件造成的损害可能会严重干扰业务连续性。团队成员无法访问文件、无法继续工作，运营放缓或停止，客户得不到充分的服务。如果个人数据已泄露，还将随之产生上报义务。面向中小企业的实用勒索软件策略必须涵盖攻击的两个方面：预防和恢复。

勒索软件是如何运作的？

Ransomware is a type of malware that prevents you from accessing devices or data, usually by encrypting files, and then demands a payment in exchange for decryption. In many cases, attackers now do more than lock files. They also steal data and threaten to leak it if the ransom is not paid, which turns the incident into both an availability crisis and a potential data breach.

Victims are often instructed to communicate through anonymous email or web pages and to pay in cryptocurrency. For small businesses, that distinction is important because cryptocurrency is anonymous, decentralized, and unregulated by traditional financial institutions: it’s almost impossible to trace payments.

勒索软件事件并不总是仅限于失去对文件的访问。它还可能意味着客户信息、员工数据、财务记录、合同或登录凭证已被窃取外泄。勒索软件可能导致无法及时访问个人数据，而且在备份不适当或不可用的情况下，甚至会造成永久性丢失。

The attack chain is usually more ordinary than you might expect. The easy-to-miss incidents that can lead to a ransomware attack include:

  • 点击了网络钓鱼链接。
  • 重复使用的密码在数据违反中遭到曝光。
  • 远程访问服务暴露在外。 
  • 已知漏洞未得到修补

Once an attacker gets access to a business network, they move laterally, escalate privileges, disable recovery paths where possible, and deploy encryption or extortion where it will hurt most. No single tool or solution can prevent ransomware attacks. Instead, organizations must focus on reducing the number of easy paths into their network.

为什么小型企业会格外频繁地成为攻击目标

Small businesses are attractive ransomware targets for a simple reason: they hold valuable data that isn’t as well-protected as it should be. Proton’s latest observatory findings show that SMBs account for 63% of breaches tracked since January 2025 and more than 352 million leaked records.

在涉及高风险数据的违反事件中，中小企业占 61%，其中仅小型企业就占这些严重事件的 48%。在泄露超过 100,000 条记录的违反事件中，中小企业占 60%，小型企业占 42%。

小型企业并非粗心大意。事实上，Proton 的 2026 年中小企业网络安全报告 表明，小型企业正在努力提升自身的网络安全水平。问题在于，它们的防御体系在真实环境中不堪一击。执行不一致、人为错误、共享访问习惯，以及有限的内部安全能力，正是这些因素使小型企业成为诱人的攻击目标。

In Proton’s survey of 3,000 leaders at companies under 250 employees, 39% said incidents stemmed from human error, and 48% said they did not have a password manager in place.

较大的公司可能已经配备了专门的响应团队、分段隔离的环境、经过测试的备份套餐以及外部事件支持。较小的企业往往只有精简的 IT 职能、外包支持，或者没有专门的安全专家。当攻击来袭时，企业不得不在运营压力下做出高风险决策。而这种压力正是勒索软件运营者所指望的。

中小企业中勒索软件最常见的入侵入口

在研究了英国开展的多项调查后，我们知道网络钓鱼仍然是企业面临的主要网络犯罪媒介。但为什么呢？因为网络钓鱼往往是凭证窃取、帐户泄露、恶意软件投放或远程访问滥用的第一步。

Weak or reused credentials are another major problem. Small businesses often have shared logins, passwords reused across multiple services, or old accounts that stay active after someone changes roles or leaves. Once attackers obtain one working login, they don’t need to hack into accounts. They can simply sign in.

From there, a poorly protected admin account, an exposed cloud console, or a remote access point without two-factor authentication (2FA) can become the bridge into a broader ransomware incident. Realistically, organizations need to deploy 2FA, least privilege access, and regular permission reviews to reduce how easily stolen credentials can be reused and how far malware can spread.

未修补的软件是另一个反复出现的入侵入口。NCSC 指出，勒索软件越来越多地通过 RDP 等暴露的服务或未修补的远程访问设备进行部署，并建议一旦有补丁可用，就尽快修补远程访问和面向互联网系统中的漏洞。对中小企业而言，这正是被忽视的问题悄然演变为攻击面的地方。

如何防范勒索软件：分层方法

没有任何单一的控制措施能够防范勒索软件。最有效的方法是分层且务实的。

从身份管理开始

团队成员帐户中的数据需要得到全面保护，以抵御勒索软件攻击。在可能的情况下，对关键业务帐户强制启用双因素身份验证，尤其是电子邮件、管理员工具、云存储空间、金融平台、远程访问点，以及任何存储客户个人数据或其他敏感个人身份信息 (PII) 的系统。

改善密码卫生习惯

攻击者并不总是强行入侵帐户。他们常常使用被盗或重复使用的凭证登录。每个企业帐户都必须拥有唯一且强健的密码，而共享访问应替换为通过企业密码管理器进行的、受管理的安全凭证分享，而不是通过电子表格、聊天或电子邮件。

Proton 自己的中小企业报告强调，即使已经拥有相关工具，企业仍然常常退回到不安全的密码分享习惯。这正是像 Proton Pass for Business 这样的安全企业密码管理器能够降低风险的地方：它帮助团队创建强健且唯一的凭证、安全地存储凭证，并以受控、安全的方式分享访问权限。

补丁管理必须严格执行

操作系统、应用、VPN、远程访问工具和边界设备的安全更新应被视为运营必需项，而非可选的维护工作。应尽快安装安全更新，并在可行的情况下启用自动更新。

强健的电子邮件和网络防护

Mail filtering, attachment controls, blocking known malicious sites, and safe browsing protections all reduce the likelihood that ransomware is delivered in the first place. Because phishing is so common, these controls are essential.

应对人为错误

Even when you’ve implemented security measures and a password policy, Security awareness training is still necessary. Training helps staff spot suspicious emails and social engineering attempts, but people will still make mistakes.

Stronger tools or features and access controls should assume that. The NCSC explicitly recommends awareness training, but Proton’s research also points out that training alone does not catch every slip. Good security design reduces the damage when someone does click by making one mistake less likely to become a full-scale incident, whether through 2FA, least-privilege access, stronger email protections, segmented access, or tested backups that support recovery.

在需要之前先保护好恢复能力

Backups need to be regular, isolated, and tested. The ICO recommends taking the 3-2-1 approach: three copies, on two different devices, with one stored off-site. The NCSC adds an important operational warning: ransomware may have infiltrated your environment before discovery, so backups should be scanned before restoration, and backup systems themselves should be protected.

凭证的关联：为什么密码在勒索软件防御中仍然重要

It is easy to think of ransomware as malware and forget that passwords play a part in a successful attack. But many ransomware incidents begin with the theft, reuse, or abuse of logins.

That might mean a staff member reusing a password from another service, a former contractor account remaining active, an admin credential being shared among several people, or an exposed remote access point being protected only by a password. Each of those shortcuts expands the attack surface.

This is one reason strong credential management belongs inside any ransomware recovery plan and prevention framework. Unique passwords per service reduce the blast radius of one stolen login. MFA makes that stolen password less useful on its own, while centralized credential storage removes the need for insecure workarounds.

安全分享意味着员工通过受控、可追踪的方法获得所需的访问权限，而不是通过非正式的密码分享。定期审查谁有权访问什么也有助于支持最小特权原则，NCSC 建议将其作为限制横向移动和扩散的措施之一。

我们已经多次撰文介绍中小企业面临的勒索软件威胁。我们一再看到同样的情况：攻击者越来越倾向于寻找更容易攻破的企业，而不仅仅是那些名气最大的企业。

如果您的中型企业遭到攻击该怎么办

1. 控制事件

如果您的企业遭到攻击，首要任务是控制事态。将受感染的设备从网络中断开连接，如果能够识别，就停用已泄露的帐户，隔离远程访问通道，保留证据，并且如果之后可能需要取证支持，请避免过快清除系统。

2. 上报事件

NCSC 建议英国组织上报事件，并提供了专门针对响应和恢复的勒索软件指南。Proton 的 事件响应指南也是构建围绕控制、调查、沟通和恢复的整体决策流程的实用参考。

3. 不要支付赎金

NCSC 和英国执法部门不鼓励、不支持也不纵容支付赎金要求。他们指出，无法保证您能重新获得访问权限，您的系统可能仍处于被感染状态，您将为犯罪群组提供资金，而且您再次成为攻击目标的可能性也更大。

ICO 同样明确表示，支付赎金并不能降低对人们的风险，也不能保障信息安全。即使对方提供了解密密钥，也无法保证它有效，或被盗数据不会被继续泄露。

4. Start recovery

Recovery should focus on slow and secure restoration. That means rebuilding from clean backups, validating that the attack path has been closed, rotating affected credentials, re-enabling access carefully, and documenting what happened. If backups are connected to live systems or have not been tested, this is often where businesses discover a second failure after the first one. A good ransomware recovery plan really starts long before an incident even occurs.

英国的上报义务：何时可能需要 ICO 介入

If a ransomware incident affects personal data, this may be a personal data breach under the UK GDPR. The ICO explains that loss of access to personal data can itself be a breach where it creates risk to individuals, and that you must notify the ICO without undue delay and, where feasible, within 72 hours if the breach is likely to result in a risk to people’s rights and freedoms. If the risk is high, affected individuals may also need to be informed without undue delay.

一些组织仍然认为，如果快速恢复了系统，或者没有明显的公开泄露，就无需上报。这种假设并不安全。ICO 的勒索软件指南明确涉及违反通知场景，并清楚说明评估取决于对个人的风险，而不仅仅是被盗文件是否已经在网上出现。

如今，勒索软件已成为中小企业的问题

小型企业遭到勒索攻击的频率越来越高，而一旦遭到攻击，影响可能非常严重，因为攻击者会利用它们的弱点。Proton 最新的违反数据清晰地表明了这一点：这一威胁可测量、正在增长，并且会干扰运营。

The good news is that the fundamentals can do much of the heavy lifting for any SMB. Measures such as using a business password manager to deploy 2FA and create unique credentials, patching, mail filtering, staff awareness, permission review, tested backups, and incident response planning may not seem flashy on their own, but together they make a meaningful difference. They reduce the chances that a single stolen password, one phishing email, or one exposed remote service escalates into a business-wide outage.