Ransomware Doesn’t Care About Your Antivirus. It Cares Whether You Can Restore.

I started doing computer support in 1983, and I’ve run COiN Services since 2002. That’s more than forty years of keeping small-business computers, phones, and networks working. Every few months someone tells me, “We’re fine — we have antivirus.” Then a morning comes when the screens are locked, the invoices are gibberish, and the antivirus didn’t stop a thing.

Here’s the plain truth I want every shop owner to hear: ransomware doesn’t care about your antivirus. It cares whether you can restore.

Malware isn’t always a weird email

Most of us still picture malware as a sketchy attachment. That’s still common — but it isn’t the whole story. This month Google’s researchers and Malwarebytes reported that device maker Videostrong built a hidden backdoor into about 1.3 million Android TV set-top boxes and sold criminals access to the resulting botnet. The malware came in the box.

Meanwhile Google pushed Chrome 157 with 213 security fixes, including seven rated Critical. And scammers keep baiting people with junk like a fake $750 Apple Cash “reward” that verifies nothing and pays nothing. Patching and skepticism matter. They just aren’t enough when someone already has a foothold.

What the numbers say this year

Sophos’s State of Ransomware 2026 surveyed 2,158 IT and security leaders whose organizations were hit in the past year:

• 56% of attacks still encrypted data (up from 50% the year before).
• Average recovery cost: $1.7 million per incident — up 11% year over year.
• When data was encrypted, 66% of those cases recovered using backups (up 12 points from 2025).
• Only 34% of smaller organizations (100–250 employees) stopped the attack before encryption, versus 46% at much larger firms.
• Email and phishing together made up about half of root causes (26% malicious email, 24% phishing).

Verizon’s 2025 Data Breach Investigations Report found ransomware in 44% of the breaches they investigated. The FBI’s IC3 2025 Internet Crime Report logged 3,611 ransomware complaints and more than $32 million in reported losses — figures that usually leave out downtime and cleanup. Sixty-three new ransomware variants showed up in a single year.

You don’t need a Fortune 500 budget to be on that list. You need a recovery plan that works when the worst day arrives.

Antivirus helps. A restore plan decides.

Keep your antivirus. Keep Chrome current. Train people not to chase fake rewards. Then ask the question that actually decides the outcome: if every file on the office PC turned into locked nonsense tomorrow, where would clean copies come from?

I’ve already covered why OneDrive, Google Drive, and Dropbox are sync tools, not backups — see Your Cloud Files Are Not a Backup. Sync mirrors mistakes as fast as good work. Ransomware loves that.

Attackers know backups are the way out, so they go after them. Backblaze cites research that about 96% of ransomware attacks specifically target backup repositories. A USB drive left plugged into the same machine, or a cloud folder an attacker can delete with stolen admin rights, is a second target — not a lifeboat. You need version history that reaches a clean day, and at least one copy ransomware can’t casually wipe.

That’s why CISA’s #StopRansomware Guide tells organizations to keep offline, encrypted backups and to test restores regularly. Their small-business backup page puts it simply: backups are your best hope of recovery from ransomware. The old 3-2-1 idea — three copies, two kinds of storage, one off-site — is still the right starting point. In a ransomware world, that off-site copy also needs to be versioned and hard for an attacker to erase.

What we’re building for our customers

At COiN Services we’ve spent this year putting together a managed, versioned, offsite backup service we call Solomon’s Vault. Important files get backed up automatically to storage that doesn’t sit on the same desk as the PC, with enough history to roll back past the day something went wrong — and with restore testing as part of the plan, not an afterthought.

I’m not here to sell you a box today. I just want the next conversation about ransomware in your office to start with “we can restore,” not “do we pay?”

A short checklist for this week

1. Name what you’d hate to lose. Accounting, customer lists, contracts, the shared drive everyone lives in.
2. Confirm a real backup exists — not just cloud sync. Separate media or an offsite service counts. A stick left in the PC does not.
3. Ask how far version history goes. If ransomware sat quietly for two weeks, can you still reach a clean day?
4. Restore one real file on purpose. Open it. Prove it. Do this before you need it.
5. Patch the boring stuff. Browser and OS updates, and a second look at odd “reward” pages.
6. Write down who you’d call if screens locked tomorrow — your IT person, your insurer, and ic3.gov for reporting.

Talk with us

If you’re not sure your current backup would survive a bad Monday, that’s a conversation worth having while things are calm. Reach out through coinservices.net and we’ll walk through what you have, what’s missing, and whether a managed offsite backup like Solomon’s Vault fits the size of your shop. No scare tactics — just a restore plan that matches the work you do.

— Ron Miller
COiN Services