Most people picture a ransomware attack the same way. Someone locks your files, you restore from a backup, and you get back to work. That picture is out of date.
The part a backup does not fix
In August 2026, the FBI, CISA and the Department of Health and Human Services updated a joint advisory about a ransomware operation called Medusa. The name matters less than the finding: the attackers copy your data before they encrypt anything.
That changes the math. If your files are locked, a real backup gets you working again. If your files were also copied, the backup does nothing about that. The gang still holds your customer list, your contracts, your payroll records and your email. Paying is the only thing they will trade for keeping quiet, and both agencies discourage it, because it does not reliably get your files back and it funds the next attack. They call it double extortion. Lock the door, and take the valuables with you.
How they get in
Medusa does not arrive with exotic tools. The advisory describes two ordinary ways in: phishing emails that steal a user's password, and software that was never updated. The second one surprises people. The advisory says these attackers put a newly announced software flaw to use within 24 hours of it becoming public. They watch the patch announcements the same way you watch your inbox.
The group does not always find its own way in, either. The advisory says Medusa buys access from brokers on criminal forums, who sell entry into networks they have already broken into. So an unpatched server or a reused password is not only a risk to you. It is inventory another criminal can sell.
The advisory lists the industries hit so far: medical, education, legal, insurance, technology and manufacturing. In the Upper Peninsula, that list is not abstract. It is the clinic, the insurance office, the machine shop and the law firm on Main Street. These attackers choose victims by who left a door open, not by who is famous.
What actually helps
You cannot back up your way out of a theft. The work happens before an attack, in three places.
Patch. Anything reachable from the internet needs its updates applied on a schedule, not whenever someone remembers. The advisory points at remote access tools and web-facing software as common entry points.
Separate. If one computer is compromised, it should not be able to walk across the whole network. Splitting up your network limits how far an intruder can travel.
Know what leaves. You cannot tell what was taken if you have no picture of where your sensitive files live and who can reach them.
Knowing where you stand
Most small businesses cannot answer those questions until someone walks through it with them. That is not a sales line. It is the reason a free assessment exists. We sit down, look at what you actually have, and tell you what is exposed and what is already fine.
The FBI's Internet Crime Complaint Center logged 3,611 ransomware complaints in 2025, up from 3,156 the year before. The agency is careful to note that its own numbers leave out the cost of downtime, lost business and cleanup, which means the real picture is worse than the report shows. You do not need to become a security expert. You need to know where you stand before an ordinary Tuesday turns into a bad month.