Protection against ransomware for small businesses in Nice and on the Côte d'Azur

Because they are the least well defended, not because they are the wealthiest. In its Panorama de la cybermenace 2025, France's national cybersecurity agency ANSSI reports that 48% of the ransomware victims recorded in France are micro, small and mid-sized businesses, against 37% a year earlier — the largest category of victims, ahead of local authorities and healthcare organisations. The agency handled 128 ransomware compromises over the year.

A twenty-strong firm in Nice or Sophia Antipolis fits the profile attackers look for exactly: data that has value — quotations, payroll, client files — a tight IT budget, no security officer in-house, and often access to the systems of a larger customer. Attackers are not targeting you by name: they scan, they find a badly protected way in, and they walk through it.

Through three doors, and nearly always the same three. Remote access open to the internet without two-factor authentication — remote desktop, a badly configured VPN, an admin interface left exposed. A reused password, found in a public breach and tried automatically against your email. An attachment or a link opened by somebody in a hurry, which installs the initial payload.

The encryption never happens on day one. The attacker first explores the network, locates the backups, escalates their rights, exfiltrates data to apply pressure, and only then pulls the trigger. It is that delay that makes monitoring worthwhile: it turns a catastrophe into an incident.

Six measures that cover most of the risk, in the order in which they pay off best. They are rolled out gradually, without stopping your business, and each one is verifiable: we show you the result rather than asking you to take our word for it.

Act in this order, and do not improvise. One: isolate — unplug the network cable and turn off Wi-Fi on the affected machines, but do not shut them down: the memory holds traces that the analysis depends on. Two: protect the backups by physically disconnecting the disks and cutting access to remote storage. Three: call a professional before restoring anything: a restore started too early reinfects the network. Four: do not pay the ransom — payment guarantees neither the key nor that your data will stay unpublished. Five: report it — a complaint to the police or the gendarmerie, and notification to the CNIL within 72 hours if personal data is involved.

Note the time of the first signs, the messages displayed and the machines affected: these details speed up the analysis and determine how good the restore will be. Say nothing publicly until you have measured the real extent of the incident.

It is costed in advance and does not move along the way. For a small business in the Alpes-Maritimes with ten to thirty workstations: initial remediation, a one-off engagement that closes the weaknesses identified and puts the backups back on a proper footing; protection and monitoring on a monthly fee, per workstation per month, covering monitored anti-virus, offsite backup, updates and support.

For scale, these amounts bear no comparison with the cost of a business shutdown lasting several days. We do not do three-year lock-ins, and we do not do surprise invoices.