How ransomware gets into a 30-person company
Almost never through a sophisticated technique. Verizon's 2026 Data Breach Investigations Report, covering incidents from November 2024 to October 2025, finds the human element present in 62% of breaches and vulnerability exploitation as the top entry point; ransomware appears in 48% of all breaches, up from 44% the previous year. In Brazil, CERT.br received 470,885 incident notifications in 2025; the overwhelming majority are scans, that is, attackers looking for open ports, and that is how a small company gets found: not by being a target, but by being exposed.
The typical sequence: a phishing e-mail or a remote desktop exposed to the internet with a reused password; from there the attacker escalates privileges, finds the backups reachable over the network and deletes or encrypts them, copies the data worth extorting and only then encrypts the servers. CISA's StopRansomware guide notes that many ransomware variants attempt to find and subsequently delete or encrypt accessible backups. The attack the company notices on Monday morning started weeks earlier.
MFA and passwords: the door that closes the cheap entry cases
The measure with the best cost-to-effect ratio is multi-factor authentication on everything exposed to the internet: e-mail, VPN, remote access, cloud console, ERP with external access, code repository. CISA states that the only widely available phishing-resistant authentication is FIDO/WebAuthn, that is, hardware keys or the device's own biometrics; codes by SMS or app are still better than a password alone, but can be intercepted by a convincing fake site.
The second measure is not having a remote desktop exposed directly to the internet: access through a VPN with MFA or through a controlled entry point. The third is one password per service, managed by a password vault, because the reused password is what turns a leak from some random website into access to your server. The article on the Binance theft covers privileged-access controls in detail; the point here is that cheap attacks come in through doors that are cheap to close.
The 3-2-1 rule and the copy ransomware cannot reach
The classic rule says three copies of the data, on two types of media, one of them off-site. It still holds, but it needs a complement that ransomware made mandatory: at least one copy that the production credentials cannot delete. CISA recommends maintaining offline, encrypted backups of critical data and notes that some cloud vendors offer immutable storage, where the copy cannot be altered or deleted for a defined period, not even by the administrator. If the same user who administers the server can delete the backup, the attacker who takes over that user can too.
Two common mistakes deserve naming. The first is thinking that a cloud service's retention is a backup: the e-mail trash, the version history of shared storage and the provider's managed database protect against user error, not against a compromised admin account that empties everything. The second is the backup that sits on the same server, or on a network drive that is always mounted: to ransomware, it is just another folder.
Restore testing: RTO and RPO in plain language
Two numbers define a backup, and neither is its size. RPO, the recovery point objective, is how much work the company accepts losing: if the backup runs daily at 11 p.m. and the attack happens at 5 p.m., the day is lost. RTO, the recovery time objective, is how soon the system has to be back: a day, an hour, fifteen minutes. Both are business decisions, not IT decisions, and each reduction costs money; the right conversation is "what does one hour of downtime cost" before "which backup tool".
And none of it is worth anything without a restore test. The article on maintaining or modernizing lists "the backup nobody ever restored" among the risk signs of an old system, and experience confirms it: a backup that was never restored is a hypothesis, not a backup. JBKR's practice is a quarterly restore into an isolated environment, using a real business process as proof, such as producing the month-end report from the restored copy, and recording how long it took. That measured time is the true RTO, and it tends to surprise people.
The LGPD does not wait: notifying the ANPD of an incident
Article 48 of the LGPD requires the controller to notify the national authority and the data subject of a security incident that may cause relevant risk or harm to data subjects. Resolution CD/ANPD 15 of 24 April 2024 set the deadlines: notification to the ANPD must be made within three working days counted from the moment the controller becomes aware that the incident affected personal data; notification to data subjects follows the same deadline; the information may be supplemented within twenty working days.
There is a lesser-known obligation in article 10 of the same resolution: the controller must keep a record of every security incident, including those not reported to the ANPD or to data subjects, for at least five years. That means the company needs to know, before any incident, who the data protection officer is, where the record lives and who decides whether a case is reportable. Three working days is plenty of time for someone who has already decided that and no time at all for someone who will find out on the day. JBKR's security page names its officer and describes how we handle data as a processor.
What an incident really costs
IBM's 2026 Cost of a Data Breach report puts the global average cost of a data breach at US$4.99 million, a record and 12% above the previous year; according to Brazilian press coverage of the same report, the average cost in Brazil reached R$7.44 million in 2026. Those numbers come from large organisations and do not apply to a 30-person company. What does apply is the structure of the bill, which is the same at any size.
The components: downtime, that is, revenue per hour of lost operation times the hours until restoration; rebuild, the internal and external team hours to reinstall, restore and validate; communication and legal, with notifications to the ANPD, to data subjects and to any customers under contract; reputation, the customers who do not come back and the ones who ask for a discount; and the ransom, if the company decides to pay, a decision that does not guarantee the data back and that, according to Verizon, 69% of ransomware victims in its dataset declined. A useful exercise: estimate each component for the scenario "main server encrypted on a Friday afternoon, most recent backup from Wednesday". The total, however rough, is usually larger than several years of immutable backups and MFA.
A one-page response plan and the next step
In April 2025 NIST published the third revision of its incident response recommendations, aligned with the Cybersecurity Framework 2.0; for a small company, the essentials fit on one page. Who decides, who executes and who communicates, with phone numbers kept outside the system, because e-mail may be compromised. Isolate: disconnect affected machines from the network without powering them off, to preserve evidence. Preserve: do not wipe logs or reinstall before copying what you can. Restore from the immutable copy, not from the copy that was on the network. Rotate every credential, starting with administrative ones. Notify the ANPD and data subjects within the deadline if personal data is involved. And write the report afterwards, with what failed and what changed.
The difference between an expensive incident and a manageable one is not the tool; it is having decided all of this beforehand. The Legate case shows the other side of the same discipline: a tax-integration migration done with zero days of billing stopped, because the rollback path existed before the cutover. At JBKR the initial 30-minute assessment is free, and the opening question about backups is a single one: when did someone last restore yours, and how long did it take?
