Ransomware Ate My Data — Here's How a Backup Saved My Business
It's 7:40am. Someone gets in before everyone else, switches on the front-office PC, and the first thing on the screen isn't the usual login prompt. Every filename in every folder now ends in a string of random characters. The invoicing system won't open. The customer database won't open. There's a message, in broken English, demanding payment in Bitcoin within 72 hours or the decryption key is destroyed forever.
That's not a hypothetical — it's the single most common way a small South African business meets the word “ransomware” for the first time: not a news headline about a bank, but a dead Tuesday morning and a countdown timer.
This post is about what happens next, and why the single cheapest decision a small business can make — a real offsite backup instead of a trusted-but-useless free one — is the difference between a bad week and losing the company.
What ransomware actually does, and how fast it moves
Ransomware is software that encrypts every file it can reach — documents, databases, invoices, accounting records — then demands payment for the key to unlock them. It doesn't trickle in over weeks anymore: industry tracking shows the median dwell time between an attacker's first foothold and triggering encryption has collapsed to four to five days, down from well over two months a few years ago (cnicsolutions.com, 2026, citing Halcyon data) — attackers move fast, and by the time anyone notices, the damage is done.
The scale isn't abstract. Sophos's State of Ransomware 2026 — a global, vendor-agnostic survey — found 56% of 2026 attacks succeeded in encrypting the victim's data, and only one in three smaller organisations stopped an attack before encryption happened at all. Sophos's South Africa-specific 2026 report (135 local organisations hit in the preceding year) put the average recovery cost — excluding any ransom paid — at over R17 million, down from R21 million the year before but still “a considerable financial burden.” Ransomware also disproportionately targets smaller businesses: one widely cited industry breakdown puts its share of small-and-midsize-business breaches at 88%, against 39% for large enterprises.
That South African sample skews toward mid-sized and larger organisations, not five-person trades businesses — but the pattern holds at every scale: the smaller you are, the less equipped you typically are to absorb the hit.
Why your “backup” might already be gone
Here's the trap almost every small business falls into, and it's the reason so many ransomware victims discover their backup is useless at the exact moment they need it most: if your backup is synced, it isn't a backup.
A folder that syncs to OneDrive, Dropbox, Google Drive, or a mapped network drive on the same infected machine is not protected from ransomware — it's a second target. The moment ransomware encrypts a file in that folder, the sync engine dutifully uploads the encrypted version to the cloud, overwriting the good copy that was there a minute earlier. Mapped network drives are worse: ransomware actively scans for every drive letter and share it can reach and encrypts those too, often faster than the local disk, because shared drives are exactly what it's designed to spread across.
This is why “we have backups, we use [cloud sync tool]” is the single most common false sense of security in a ransomware incident. The backup exists. It's also encrypted.
A real backup has to be disconnected from the systems it protects — not reachable by the same ransomware process that just took down the production machine — and it has to keep multiple versions over time, not just the latest sync, so you can roll back to the file as it looked yesterday, or last week, before the encryption happened.
The scenario: a logistics company's bad Tuesday
What follows is a composite, built from the pattern of ransomware incidents and backup recoveries we see across small South African businesses — not one single client, because the first thing every real victim asks for is that their name never appears anywhere near the word “ransomware.” But every detail in it — the entry point, the spread, the panic, the recovery mechanics — reflects documented, real-world cases, cited throughout this post.
A small logistics company — a handful of staff, a yard, a dispatch office, the PCs running the invoicing and tracking system that keeps trucks moving — had what most small businesses have: antivirus, a password-protected server, and a vague sense that backups were “handled.” What it didn't have was a managed, offsite backup, or a patched, monitored fleet of PCs.
The entry point, in the overwhelming majority of cases like this, is mundane: a phishing email opened mid-inbox-rush, or an exposed remote-access port into an unpatched Windows machine — exactly the gap that regular restarts and governed patching exist to close (see why restarting your PC actually matters; unpatched machines on old Windows Update cycles are precisely what ransomware goes looking for). Once inside, the attacker had days, not hours, to move quietly through the network before triggering encryption — consistent with the dwell-time pattern above.
Monday night, the encryption ran. Tuesday morning, every PC in the dispatch office showed the same ransom note. The invoicing system was dead. The customer and load-tracking database — years of client history — wouldn't open. Antivirus had been running the whole time; it caught nothing, because by the time encryption fires, antivirus's job is already over (see why antivirus alone isn't enough). For about twenty minutes, the only conversation in that office was whether the business could survive losing that data outright.
It didn't have to. The business's offsite backup agent — disconnected from the infected machines, running on its own schedule, storing its own version history off-site — had copies from every night going back weeks, none of them reachable by the ransomware because they were never mapped, synced, or logged into from the infected machines in the first place. Restoring the invoicing database and dispatch records started that same morning and had the business operational again within the working day, not days or weeks later. The PCs still needed reimaging and the entry point still needed closing, but the thing that actually mattered — the data — was never lost.
The backup difference: what made recovery possible
Three properties separated this backup from the synced folder sitting uselessly encrypted on the server:
- Air-gapped — not a mapped drive, a logged-in cloud account, or anything else reachable from the machines it protects. Ransomware can't encrypt what it can't see.
- Time-versioned — daily (or more frequent) snapshots going back weeks, not one “latest” copy. If an infection sits quietly for four or five days before triggering encryption (today's average dwell time), you need a version from before that window.
- Off-server — different infrastructure entirely, not a second folder on the same machine or network segment.
This is also the exact point our existing piece on why offsite backups matter makes in more general terms — this post is that same argument, with the ransomware scenario where it bites hardest.
What this actually costs — two numbers that matter
R120/month per device, plus roughly R1/GB/month for storage (with volume discounts at scale) is Gigahost's offsite backup pricing today — often less than one hour of billable time per month for a small business.
Compare that to the alternative. Global research from Sophos and IBM puts the average total cost of a ransomware incident — downtime, remediation, legal exposure, business disruption — at several million US dollars, skewed upward by large enterprises with complex environments. For businesses closer to Gigahost's own client base — a handful of staff, a single site, modest but critical systems — the realistic total loss when ransomware hits without a working backup typically lands in the R150,000–R500,000 range: days of lost trading, idle staff, emergency IT labour to rebuild from nothing, reputational damage, and, in the worst cases, a ransom payment with no guarantee the key even works. South Africa's own Sophos figures — R17 million average recovery cost across mid-to-large local organisations — show the same pattern at a bigger scale: the number without a backup is never small, it's just a question of how many zeros.
R120 a month against a R150,000–R500,000 hole in the business isn't a marginal insurance argument. It's close to the cheapest risk-reduction decision available to any small business in South Africa today.
POPIA: this isn't just a cost problem, it's a legal one
If your systems hold any personal information — staff records, customer names and ID numbers, delivery addresses, payment details — South Africa's Protection of Personal Information Act 4 of 2013 (POPIA) already applies to you, and losing it to ransomware isn't just operational, it's a compliance failure.
Section 19 requires every “responsible party” (your business, legally) to take “appropriate, reasonable technical and organisational measures” against loss, damage or unauthorised destruction of personal information — including identifying risks, putting safeguards in place, and regularly verifying they actually work. A backup that's never been tested, or that turns out to be encrypted too because it was never really disconnected, is not a safeguard the Information Regulator will treat as “reasonable” after the fact.
The penalties aren't symbolic. Under Sections 107 and 109, serious contraventions carry fines of up to R10 million, imprisonment of up to 10 years, or both — and the Regulator explicitly weighs whether the breach was preventable. A ransomware incident that wipes out your customers' only data copy, with no tested recovery plan on record, invites exactly that scrutiny. A working, regularly tested offsite backup is one of the most concrete safeguards a small business can point to.
How offsite backup actually works (no jargon required)
None of this requires you to understand the technology. Here's the whole picture in plain terms:
A small piece of software (an “agent”) runs quietly on each PC or server you want protected. On a schedule — usually overnight, so it never slows your working day — it copies anything new or changed to storage that lives somewhere else entirely, outside your office network. Every run is kept as its own point in time, going back weeks, so you're never stuck with only “the most recent” copy if that's the one that's already compromised.
Gigahost runs this on UrBackup, the same infrastructure behind our own hosting platform's daily backups — proven, restore-tested, not experimental. The one step too many small businesses skip is the part that matters most: testing a restore before you need one, not just trusting a backup job “completed successfully” every night. A backup nobody has ever restored from is a belief, not a safeguard — and it's the exact gap that turns a bad Tuesday into a closed business.
What to do right now
- Check what's actually protecting your data today. If the honest answer is “a synced folder” or “an external drive someone plugs in sometimes,” that's not a ransomware-safe backup.
- Ask when it was last restored, not just when it last ran. If nobody can answer that, treat it as unprotected until proven otherwise.
- Close the door ransomware usually comes through. Keep software patched (see why restarting your PC matters); don't rely on antivirus alone (see why antivirus needs managed support behind it).
- Put a number on what downtime would cost you. Multiply a day without your invoicing system or customer records by how long recovery takes without a backup — the R120/month starts to look like the cheapest decision you'll make this year.
The free way to find out where you stand
You don't need to take our word for any of this. Gigahost offers a free IT health check — we look at what's actually protecting your systems today, whether your backup would survive a real ransomware incident, and whether your current setup would hold up if the Information Regulator ever came asking. No obligation, no sales pressure, just a straight answer.
For businesses that want it handled end-to-end, our Managed IT Tier 3 plan (R65/endpoint/month) bundles governed patch management, licensed antivirus, monitoring and SLA-backed support — the combination that stops most ransomware before a backup is the only thing standing between you and that R150,000+ hole. If you just need the backup piece on its own, offsite backup is available standalone on top of whatever IT support you already have, at the pricing above.
Not ready for a call? Send a message first.