Article summary: Ransomware has moved from a single act of encryption to a multi-stage extortion campaign. Ransomware resilience beyond backups means pairing recovery plans with faster detection, tighter network segmentation, and a tested incident response process. Together, these layers stop a single compromise from turning into a business-ending event. A ransom note used to be the clearest sign of a ransomware attack: your files were encrypted, your systems were locked and someone wanted money to give them back. Today, the threat is more complicated. Attackers may steal sensitive data before encrypting anything, move quickly through connected systems and use that stolen information as another way to pressure a business into paying. That is why a layered approach to IT security matters. Backups are still essential, but restoring your files cannot undo a data breach. Understanding what ransomware resilience looks like today starts with understanding how the attack itself has changed.
How Ransomware Attacks Have Changed
Encryption used to be the main source of leverage. Today, attackers have more ways to pressure a business into paying.
From locking files to stealing them
Many ransomware attacks now involve stealing data before systems are encrypted. This “double extortion” gives attackers another bargaining chip: even if you can restore everything from a backup, they still have your data. That is becoming a serious problem in Singapore. Proofpoint found that 75% of Singapore organisations affected by ransomware had data stolen. Among those that paid a ransom, 45% faced another demand. In other words, paying does not necessarily end the problem.
Attackers are working together faster
The cybercriminal ecosystem has also become much faster. Some groups specialise in getting into a network and then hand that access directly to another group that carries out ransomware or another high-impact attack. According to Google Cloud’s M-Trends 2026 report, the median time between initial access and this handoff fell from more than eight hours in 2022 to just 22 seconds in 2025. For small businesses, that leaves very little room for a slow response once suspicious activity is detected. The threat is particularly relevant in Singapore. The Cyber Security Agency of Singapore recorded 165 reported ransomware cases in 2025, with SMEs among the organisations most affected.
Why Backups Alone Fall Short
A solid backup strategy still matters. It is the foundation of any recovery plan, and if you have not reviewed yours recently, our guide to managed backup services is a good place to start. But a foundation is not the whole building. Backups help you recover data after an attack. They cannot stop attackers from stealing that data first or threatening to publish it later. Ransomware groups may also target accessible backups to make recovery more difficult. That means your backups need protection too. Recovery copies should be isolated from everyday systems, properly secured and regularly tested to make sure they actually work when needed. Backups are still essential. They are simply one layer of ransomware protection, not the entire plan.
Building Ransomware Resilience Beyond Backups
Ransomware resilience comes down to three things: spotting an attack quickly, limiting how far it can spread and knowing what to do next.
Detect suspicious activity early
Antivirus is still useful, but ransomware attacks do not always begin with an obvious malicious file. Attackers may use stolen credentials or legitimate tools to move through your systems. Endpoint detection and response (EDR) can monitor devices for suspicious behaviour, helping your IT team identify and contain an attack before more damage is done.
Limit how far an attack can spread
Network segmentation helps prevent one compromised device from providing easy access to everything else. Combined with the access controls used in Zero Trust Architecture, this can help contain an attack rather than allowing it to spread across the business.
Write the response plan before you need it
An incident response plan should answer a few practical questions:
- Who can isolate affected systems?
- Who contacts employees, customers and regulators if necessary?
- How will backups be restored and tested?
- How will the business keep operating during recovery?
This preparation is particularly important for smaller businesses. Singapore’s Cyber Security Agency says SMEs continue to be disproportionately affected by ransomware, citing factors including lower cybersecurity maturity and limited resources. CSA now provides up to 70% support for eligible SMEs adopting CISO-as-a-Service, helping smaller businesses assess their security and build a practical cybersecurity roadmap.
Is Your Business Ready for What Comes After Encryption?
Backups are still essential, but today’s ransomware threats require more than a good recovery plan. Businesses also need to detect attacks early, limit how far they can spread and have a clear plan for responding when something goes wrong. The good news is that you do not have to start from nothing. The right security layers can build on the backup strategy you already have. If you are unsure whether your current setup is ready for a modern ransomware attack, Managed IT Asia can help you find the gaps. Call us at +65 6814 0818 or contact our team online to arrange a practical review of your ransomware defences.
Article FAQs
What is double extortion ransomware?
Double extortion is when attackers steal data as well as encrypting systems. They can then threaten to publish or sell the stolen information, meaning restoring your files from a backup does not eliminate the threat.
Are backups still important for ransomware recovery?
Absolutely. Reliable backups remain one of the most important parts of ransomware recovery, but they should be protected and regularly tested. They also need to be part of a wider security strategy that includes early detection, access controls and an incident response plan.
How fast can modern ransomware attacks move?
Some attacks can develop extremely quickly. Google Cloud’s M-Trends 2026 report found that, in cases involving handoffs between threat groups, the median time from initial access to handoff fell to just 22 seconds in 2025. The takeaway for small businesses is simple: early detection and a quick response matter.
MANAGED IT ASIA, we are an IT Support, IT Solutioning and Managed IT Service Provider specializing in serving Small Businesses across Asia. Call us at +65 6748 8776 and let us manage your Small Business IT today!