Yes, ransomware can hit a small business website. Attackers who get into your server or hosting account can encrypt or delete your files and database, or steal customer data and threaten to leak it. Your best defence is a backup they can’t reach: stored off-site, behind a separate login, with weeks of history, and tested so you know it restores.
Key takeaways
- The ASD calls ransomware the most disruptive cybercrime threat facing Australia.
- A backup on the same server, or reachable with the same password, can be locked or deleted along with the site.
- Ransomware-ready backups are off-site, separately secured, kept for weeks and regularly test-restored.
- The ASD’s advice is never to pay. Larger businesses that do pay must report it within 72 hours.
What is ransomware?
Ransomware is malware that locks your devices or encrypts your files so you can’t use them. The criminals then demand a payment, often in cryptocurrency, to restore access or to stop them leaking your data online (ASD).
It’s a growing problem in Australia. The ASD’s latest annual report calls ransomware “the most disruptive cybercrime threat” of 2024–25. Its cyber security centre responded to 138 ransomware incidents that year, and 39% of those started with the ASD contacting the organisation to warn it (ASD Annual Cyber Threat Report).
Can ransomware affect a website?
Most headlines are about office networks, but websites are exposed in three ways:
- Locked or deleted files. An attacker with access to your server or hosting account can encrypt or wipe the website’s files and database.
- Stolen data. Contact form entries, customer accounts and order details can be copied and used for extortion, even if the site keeps running.
- Fake ransom notes. In 2021, Sucuri investigated WordPress sites showing a demand for 0.1 Bitcoin. Nothing was actually encrypted: a hacked plugin had hidden the pages (Sucuri).
In every case, the way in is the same as any other hack: an outdated plugin, a stolen password or a weak hosting account. That’s why the steps that prevent ordinary hacks also prevent website ransomware.
Why do backups decide how bad it gets?
With a clean backup, ransomware becomes a restore job measured in hours. Without one, you’re choosing between rebuilding from scratch and dealing with criminals. The ASD puts it plainly: the best way to recover from ransomware is to restore from an unaffected backup.
The catch is the word “unaffected”. The ASD warns that backups may be hit too if they were stored on the infected device or connected to the same network (ASD). For a website, that means a backup in the same hosting account, or one anyone with your hosting password can delete.
What makes a website backup ransomware-ready?
- Off-site. Stored in a different system from the web server, so one break-in can’t reach both.
- Separately secured. Your website or hosting password shouldn’t be enough to delete it.
- Kept for weeks. Attackers sometimes get in days or weeks before they strike, so the latest copy may already contain their backdoor.
- Complete. Files and database together, taken automatically on a schedule.
- Tested. Someone has restored one recently and checked the site works.
Many hosts offer server snapshots, and they’re useful, but they’re not the same thing. Our guide to website backup vs snapshot explains the difference. If you’ve never checked, ask the question in our article does my host back up my website.
Should you pay the ransom?
No. The ASD’s advice is never to pay. Paying doesn’t guarantee you’ll get your data back, or that the criminals won’t sell or leak it anyway, and it can make you a target for more attacks.
There’s also a legal duty for larger businesses. Since 30 May 2025, a business with annual turnover of $3 million or more that pays a ransom, or knows one was paid for it, must report the payment to the ASD within 72 hours (Home Affairs).
If customer data was taken, privacy law may apply too. Businesses covered by the Notifiable Data Breaches scheme must assess a suspected breach within 30 days (OAIC).
What should you do if your website is hit?
- Don’t pay, and don’t panic-delete. Take screenshots of any ransom note and note the time.
- Contain it. Ask your host to take the site offline or into maintenance mode, then change hosting, WordPress and database passwords from a clean device.
- Check the backups before you use them. The ASD warns that restoring an infected backup can bring the malware straight back. Pick a copy from before the break-in.
- Restore, then close the hole. Update everything and remove unknown admin users and files. Our guide to how to restore a website from backup walks through the process.
- Report it. Use ReportCyber at cyber.gov.au, or call the ASD hotline on 1300 CYBER1 (1300 292 371), available 24/7.
If you can’t find a clean backup, or the attacker keeps getting back in, get help. Our hacked website repair service cleans the site and closes the way in.
How do we keep websites ransomware-ready?
Our website backups you can restore are stored off-site and kept for 30 days. They run daily on Essentials, four times a day on Advantage and hourly on Elite. Advantage and Elite include unlimited restores (fair use).
Backups are only half the job, so our website maintenance plans also cover the ways attackers get in: updates, firewall and login protection, and daily malware scans. Sites on Maintain & Protect are covered by our promise: hack-free or we fix it free.
Frequently asked questions
Is my small business too small to be hit by ransomware?
No. Most attacks on websites are automated: bots scan the internet for outdated plugins and weak passwords, and they don’t check the size of the business first. A small site with no off-site backup can be harder to recover than a large one with a recovery plan.
Will my web host’s backups protect me from ransomware?
Maybe. Ask where the backups are stored, how long they’re kept and whether your hosting login can delete them. Backups on the same server, or only a few days old, may not help if the attacker was inside for a week before striking.
How long should I keep website backups?
At least several weeks. Attackers sometimes get in quietly and wait, so the most recent copies may already contain their files. We keep 30 days of off-site backups so there’s a clean point well before most break-ins.
Do I have to report a ransomware attack?
If your business turns over $3 million or more and pays a ransom, you must report the payment within 72 hours. Anyone can report an attack through ReportCyber, and the ASD encourages it. If personal data was involved, check whether the Notifiable Data Breaches scheme applies to you.
Can I get my website back without paying?
Usually, if you have a clean backup from before the attack. The site is restored from that copy, the way in is closed and passwords are changed. Without a backup, recovery may mean rebuilding the site, which is why the backup setup matters before anything happens.
Sources
- Learn about ransomware, Australian Signals Directorate
- Annual Cyber Threat Report 2024–25, Australian Signals Directorate, October 2025
- Fake ransomware infection spooks website owners, Sucuri, November 2021
- Steps to take following a ransomware attack, Australian Signals Directorate
- Factsheet: Mandatory ransomware and cyber extortion payment reporting, Department of Home Affairs
- Quick reference guide for responding to data breaches, OAIC