Ransomware Recovery: What UK Business Leaders Need to Know Before It's Too Late
Ransomware is no longer a threat that only happens to other people’s businesses.
According to the UK Government’s Cyber Security Breaches Survey 2025, ransomware attacks against UK businesses doubled in a single year, from under 0.5% to 1% of businesses, affecting around 19,000 organisations. The average cost of recovering from an attack, excluding the ransom itself, now sits at $2.58 million. And in 70% of UK attacks, the victim’s data was successfully encrypted.
For a law firm, an accountancy, or a consultancy, that is not just an IT problem. That is an existential one.
What most business leaders do not realise is that the time to think about ransomware recovery is not after an attack. It is now, before you need it.
Why "Backup Successful" Doesn't Mean You're Protected
There is a dangerous assumption sitting inside most organisations: that because backups are running, recovery is guaranteed.
Modern ransomware operators know this. They do not just encrypt your live data. They look for your backups first. If they can destroy or encrypt your recovery copies before you notice the attack, you have no options left. Pay, or lose everything.
Seeing “Backup successful” on a report tells you a file was written somewhere. It tells you nothing about whether you could actually rebuild your business from it.
There are three things worth verifying before you find out the hard way.
1. When Did You Last Test a Full Restore?
Not a file check. Not confirming that a folder is visible. A full rebuild, as if your office no longer exists and you are starting from nothing.
If your team cannot give you a date within the last three months, you are not testing your recovery capability. You are hoping it works.
A backup that has never been restored is not a backup strategy. It is an assumption. And assumptions do not hold up when a ransom clock is ticking and your clients are waiting for their data.
Full restore testing should be a scheduled, documented exercise, not something done reactively when something looks wrong.
2. Are Your Backups Immutable?
Immutable backups are stored in a way that cannot be changed or deleted for a defined period of time, not by a hacker, and not even by your own IT team.
Why does that matter? Because if an attacker gains admin credentials, and in many incidents they do, they can walk straight into a conventional backup system and delete everything. In under an hour, your entire recovery capability can be gone.
Immutability removes that option. A locked backup cannot be overwritten, regardless of who has access. It is one of the most effective controls available for ransomware recovery, and one of the most commonly missing.
3. Is One Copy Completely Offline?
If every copy of your data is connected to your network, ransomware can reach every copy. It is that simple.
The 3-2-1 backup principle has been around for years, and it still holds: three copies of your data, on two different types of storage, with one kept completely offline. Air-gapped, disconnected, unreachable.
An offline copy cannot be encrypted by ransomware. If the infection cannot see the drive, it cannot touch it. For professional services firms handling sensitive client data, that offline copy may be the difference between a serious incident and a business-ending one.
What Ransomware Recovery Actually Looks Like
Recovery is not just restoring files. It is rebuilding your entire environment, communicating with clients, managing regulatory obligations, and getting your people back to work, potentially under significant time pressure.
For regulated firms, there are additional considerations. The SRA expects law firms to have appropriate business continuity arrangements in place. ICAEW guidance similarly requires accountancies to demonstrate resilience. A ransomware attack that takes your systems offline for days or weeks is not just an operational disruption. It may also be a compliance failure.
The businesses that recover fastest from ransomware attacks are not necessarily the ones with the largest IT budgets. They are the ones that have a tested, documented recovery plan and a backup architecture built to survive an attack.
Questions to Ask Your IT Team This Week
You do not need to be a technical expert to have this conversation. These four questions will tell you a great deal about where you actually stand:
- When did we last do a full restore test, and what was the result?
- Are our backups immutable, and for how long are they locked?
- Do we have an offline copy of our data that is completely disconnected from the network?
- If we were hit tomorrow, how long would it take to be operational again?
If the answers are vague or the last test date is more than three months ago, that is worth addressing now.
