It’s a busy day in the office and suddenly your computer screen freezes with a pop-up message from a legitimate-looking organization saying you have violated some law and the computer will remain locked until you pay a fine.

Of course, there’s nothing legitimate about it.

This is a ransomware scam – and one of the most worrisome trends on the threat landscape today. With menacing names like ‘CrytoWall’, ‘CoinVault’ and ‘CrytoLocker’, experts warn that criminals are increasingly using ransomware to commit cyber crimes.

Here’s what a workplace needs to know about the ransomware threat to businesses.

What is ransomware?

Ransomware is a malicious type of malware that infects computers and digitally locks a victim’s computer system or files until a ransom is paid. The newest ransomware threats can also infect network- attached storage devices, according to the Threat Report H22014 by anti-virus vendor F-Secure.

How it happens

A computer becomes infected when a user clicks on an infected advertisement, opens an email attachment that contains malware, or visits an infected website – all of which allows the malware into the computer.

Who’s at risk?

Everyone – individuals as well as businesses, financial institutions, government agencies, academic institutions and other organizations are being targeted and infected.

How ransomware can hurt your business

According to an FBI statement, the typical victim pays the criminal between $200 and $10,000. But there are other costs too, associated with network mitigation and countermeasures, loss of productivity, legal fees, IT services, and credit monitoring services. Between April and June this year, 992 Crypto-Wall-related complaints cost victims over $18 million.

What should you do if it happens?

If ransomware takes over your computer, immediately disconnect from the internet, advises the FBI. Alert the appropriate legal authorities, and file a complaint at www.IC3.gov.

It’s difficult to decrypt affected files without a decryption key. Consult with IT experts about whether the ransomware is ‘simple’ enough to remove. Or, restore the affected files if possible from a clean, recent backup onto a cleaned system.

About 30% of victims pay to regain their data, according to Tom Kellermann, Trend Micro chief cybersecurity officer, in a Wall Street Journal article.

Safeguards

Schedule regular backups and store the backed-up data offline. Protect against ransomware by using layered defenses to block malware delivery. Enable automated patches for the operating system and web browser. Also, use antivirus and anti malware software, firewalls, and pop-up blockers (pop-ups are regularly used by criminals to spread malicious software).

Other security policies and procedures

Employee work habits are critical, and it’s important they receive on-going security awareness training about web browsing and email practices. For example, download software only from trusted sites, and never click on URLs contained in unsolicited emails.The same precautions should apply with mobile devices. There should be a culture of security in the workplace with a comprehensive information security policy, a Chief Information Security Officer, and information security procedures such as secure document destruction.

Track the lifecycle of a document to see where you can improve security protocols in your office. To keep your documents secure throughout their lifecycle, learn more about Shred-it’s paper shredding services.