Ransomware & Incident Response: What Richmond Businesses Need to Know in 2025

Stacy Aitkens, Cybersecurity Program Director

When a security incident strikes, every minute counts. As ransomware attacks continue to evolve and target businesses of all sizes, having a solid understanding of current threats and a clear response plan isn't just good practice—it's essential for business continuity.

At pim, now Aligned Tek, we work alongside Richmond businesses every day to help them stay protected and prepared. Here's what you need to know about ransomware trends, incident response planning, and how to act quickly when it matters most.

Ransomware in 2025: New Trends Affecting Richmond Businesses

Ransomware isn't slowing down—it's getting smarter. Here are the trends we're seeing that directly impact our local business community:

Double and Triple Extortion Attackers aren't just encrypting your data anymore. They're stealing it first, then threatening to publish sensitive information if you don't pay. Some are even contacting your customers or partners directly with threats. This means the stakes are higher than ever, even if you have solid backups.

Targeting Managed Service Providers and Supply Chains Cybercriminals have figured out that compromising one MSP or vendor can give them access to dozens of clients. This is why we take security in our own operations so seriously—and why we help you evaluate the security practices of your vendors and partners.

Ransomware-as-a-Service (RaaS) Professional ransomware operations now sell their tools and infrastructure to less sophisticated attackers. This means more frequent attacks from a wider range of threat actors, making it harder to predict where threats will come from.

Focus on Smaller Organizations The myth that "we're too small to be a target" is more dangerous than ever. Automated attacks don't discriminate by company size, and smaller organizations often have fewer security resources, making them attractive targets.

Exploiting Remote Work Infrastructure As hybrid work becomes the norm, attackers are focusing on VPNs, remote desktop protocols, and cloud services. If your remote access security hasn't kept pace with how your team works, you may be vulnerable.

The good news? Understanding these trends helps us build better defenses. The key is staying proactive rather than reactive.

Building an Effective Incident Response Plan

An incident response plan is like a fire drill for cyberattacks. You hope you'll never need it, but when something happens, having practiced steps to follow makes all the difference.

What Should Your Plan Include?

Clear Roles and Responsibilities Who discovers the incident? Who decides whether to shut down systems? Who communicates with staff, customers, and potentially law enforcement? Document specific names and contact information for your response team, including your IT provider, legal counsel, cyber insurance carrier, and key executives.
Detection and Assessment Procedures How will you know if something's wrong? Your plan should outline the warning signs your team should watch for and how to report them. Include steps for quickly assessing the scope and severity of an incident.
Containment Strategies When an attack is discovered, quick containment can prevent it from spreading. Your plan should detail which systems to isolate, how to disconnect compromised devices, and when to take systems offline entirely.
Communication Protocols Who needs to know what, and when? Your plan should address internal communication (keeping staff informed without causing panic), external communication (notifying affected customers or partners), and regulatory requirements (some breaches require reporting within specific timeframes).
Recovery Procedures Document your backup locations, recovery priorities (which systems need to come back online first), and the steps for safely restoring operations. Include verification steps to ensure systems are clean before bringing them back online.
Post-Incident Review After every incident—or even after a drill—take time to review what worked and what didn't. Update your plan based on these lessons learned.

Making Your Plan Work

The best incident response plan is one your team actually knows how to use. Consider these steps:

Keep it accessible: Store copies in multiple locations, including offline and outside your network
Review it regularly: Technology and your business change—your plan should too
Practice it: Run tabletop exercises where your team walks through different scenarios
Update contact information: Nothing's worse than calling a phone number that's no longer in service during an emergency

Your vCIO can help you develop a plan tailored to your specific business operations, compliance requirements, and risk profile.

When Minutes Matter: Rapid Response to Security Incidents

The first hour after discovering a security incident can determine whether you face a minor disruption or a major crisis. Here's how to make those critical minutes count.

Immediate First Steps

Stay Calm and Document Panic leads to poor decisions. If you or someone on your team discovers a potential security incident:

Take a breath
Document what you're seeing (screenshots, notes about unusual behavior)
Don't delete anything yet—you may need evidence

Contact Your IT Team Immediately Call your vCIO or IT provider right away. Don't wait to see if the problem resolves itself, and don't try to fix it alone. Early professional involvement dramatically improves outcomes.

Disconnect—Carefully Isolating infected systems prevents ransomware from spreading, but how you disconnect matters. If possible:

Disconnect from the network (unplug ethernet, disable Wi-Fi) rather than shutting down
Leave systems running if IT advises—turning off an encrypted system might make recovery harder
Document which systems you've isolated

Don't Pay Immediately If you see a ransom demand, don't rush to pay. Contact your IT provider, cyber insurance carrier, and potentially law enforcement. Payment doesn't guarantee you'll get your data back, and it may fund future attacks.

The Power of Preparation

Businesses that respond quickly and effectively share common traits:

They have current, tested backups stored offline or in immutable storage
Their team knows who to call and has contact information readily available
They've practiced their response plan through tabletop exercises
They have cyber insurance and understand their policy's requirements

The goal isn't just speed—it's informed, coordinated action. Your IT team needs to assess the situation, contain the threat, and develop a recovery strategy. Your role is to provide information, make decisions about business operations, and communicate with stakeholders.

Real-World Recovery: Learning from Experience

While we can't share specific client details without permission, we can tell you what makes the difference between a quick recovery and a prolonged disruption.

What We've Learned from Incident Response

Backups Save Businesses—When They Work The most successful recoveries involve businesses that:

Test their backups regularly (discovering a backup doesn't work during an attack is devastating)
Store backups offline or in immutable storage that ransomware can't reach
Have documented recovery procedures
Know their backup retention period and recovery time objectives

Communication Prevents Chaos Organizations that maintain clear communication throughout an incident experience less operational disruption. This means:

Keeping employees informed about what's happening and what they should do
Notifying customers proactively when services may be affected
Working transparently with cyber insurance carriers and any regulatory bodies

Speed Depends on Preparation Businesses that recover quickly didn't get lucky—they prepared. They had:

Updated incident response plans
Regular security awareness training for staff
Current documentation of their IT environment
Established relationships with response partners

Prevention Is Still Cheaper Than Recovery Even with insurance and good backups, recovering from ransomware involves costs: downtime, staff hours, potential data loss, and the stress on your team. The businesses that fare best are those who invest in prevention:

Regular security updates and patch management
Multi-factor authentication on all critical systems
Email security to block phishing attempts
Endpoint detection and response tools
Network segmentation to limit attack spread

Moving Forward: Your Next Steps

Cybersecurity can feel overwhelming, but you don't have to tackle it alone. Here's how to start strengthening your defenses:

If you don't have an incident response plan: Reach out to your vCIO to begin developing one. Even a basic plan is better than none.

If you have a plan: When did you last review it? Schedule time to update contact information, review procedures, and consider running a tabletop exercise.

If you're unsure about your backups: Ask your IT team to verify your backups are working and test a recovery. Don't wait for an emergency to discover a problem.

If you want to improve your security posture: Consider a security assessment to identify your biggest vulnerabilities and prioritize improvements.

Remember, effective cybersecurity isn't about achieving perfection—it's about continuous improvement and being prepared to respond effectively when incidents occur.

Back to Blog