When you see news of KADOKAWA (Niconico), Toyota or Asahi Group being hit by ransomware, many of you may worry, "Could my company be targeted too?" or "Do we need to do something?"
To put it plainly, ransomware is not just a problem for large companies. According to National Police Agency (NPA) statistics, 116 cases were reported in the first half of 2025 alone, and the victims were by no means limited to large enterprises.
(Reference: NPA Cyber Affairs Bureau, "Threats in Cyberspace in the First Half of 2025")
What makes ransomware attacks so troublesome is that the damage does not end as "an IT department problem." Areas that must not stop, such as patient care at hospitals, logistics at ports and client operations at outsourcing (BPO) providers, are targeted again and again. Moreover, it has recently become common for attackers not only to encrypt data but also to steal it and threaten to "publish it," which tends to prolong the impact.
In this article, we use real ransomware incidents to explain how serious the threat is and which countermeasures you should start on right away.
- 15 recent incidents (mostly in Japan, plus 2 overseas)
- How each industry is targeted (healthcare, manufacturing, SMEs)
- The reality of entry points (centered on VPN and remote access)
- Countermeasures to start now (prioritized) and initial response steps if the worst happens
Note that preventive measures are essential against ransomware attacks, and vulnerability assessments and penetration testing are effective. CyberCrew has multiple white-hat hackers on staff who evaluate risk through realistic testing that starts from the points attackers actually target. Contact us for a free consultation.
What Is Ransomware? The Basics, Explained Simply
Make sure you have a solid grasp of the basics of ransomware.
Ransomware is a word combining Ransom + Software. It is an attack that encrypts data on devices and servers, brings the victim's operations to a halt, and then demands money "if you want it back."
When you are hit, it is not just that encrypted files can no longer be opened. A company's "day-to-day operations themselves," such as ordering, accounting, internal email and factory management systems, can stop.
What has become even more serious in recent years is that attacks no longer end with encryption: double extortion, in which attackers steal information beforehand and threaten "pay, or we publish it," has become the norm. In other words, even if you can recover from backups, a separate burden of handling the data leak (notifying customers, investigating, preventing recurrence and restoring trust) tends to remain.
In Japan, ransomware has also ranked near the top for many years in the "10 Major Information Security Threats (Organizations)" list published by the "Information-technology Promotion Agency, Japan (IPA), the IT policy implementation agency of the Ministry of Economy, Trade and Industry (METI), and in 2025 it ranked No. 1 for the "10th consecutive time." This shows it is not a passing trend but a risk that companies and organizations must prepare for.
Latest Trends in Ransomware Damage
Recent ransomware damage is characterized not only by a rising number of cases, but also by the tendency for business disruption, data leaks and recovery costs to occur all at once.
It does not end with restoring systems; the burden drags on to include external explanations and measures to prevent recurrence.
Below, we break down "why they are targeted" by industry and company size.
Why healthcare organizations are targeted
At healthcare organizations, when electronic medical records, testing or billing systems stop, patient care itself becomes difficult to provide, which is directly tied to human life and regional healthcare.
For that reason, attackers tend to see them as places where "staff are pressed to recover quickly, so pressure to pay builds easily." In fact, Osaka General Medical Center has disclosed that its electronic medical records and other systems were affected and that recovery took a long time. (Reference: Osaka General Medical Center, "About the Incident Investigation Report")
In addition, healthcare settings tend to lack IT staff and security budgets and to fall behind in replacing legacy equipment, so patching VPNs and peripheral devices often gets put off. There are also cases of intrusion via contractors, such as food service or system operations providers, so protecting the hospital alone is not enough.
Vulnerabilities in manufacturing and the supply chain
Manufacturing is an industry where, when core systems or factory networks stop, production lines stop, which leads straight to a halt in revenue.
Particularly in supply chains that minimize inventory, such as just-in-time (JIT: a system that produces and supplies only what is needed, when it is needed, in the amount needed), a stoppage in a single process can trigger a chain of delivery delays, and the impact on business partners spreads all at once.
In the Toyota case, damage that occurred at a supplier spread and led to production stopping in Japan.
Furthermore, attackers judge that using business partners, subsidiaries and contractors, whose security tends to be relatively weaker, as a stepping stone has a higher success rate than attacking the main company head-on. That is why in manufacturing it is important to bring the level of countermeasures up to par across the whole supply chain, not just within your own company.
Why SMEs account for most ransomware damage
The reason SMEs are said to be "easy targets" is not that they have some special weakness, but that several factors common in the workplace are present. The three typical causes are:
- No dedicated security staff
The person in charge of IT also handles general affairs or accounting, so day-to-day operations inevitably take priority. It is not that security measures are "not done," but that they easily get put off. - Updates to VPN and remote access devices tend to be postponed
"As long as it works, I don't want to touch it; stopping it would affect the business." We understand this mindset well. But attackers target exactly that "time when it hasn't been updated." - There are backups, but not in a "recoverable form"
Some organizations feel reassured just because backups exist, but what actually matters is "to what point in time can you restore," "does the restoration procedure work," and "is it isolated from the network." Only after testing these does it become a "usable backup."
When these three factors overlap, attackers do not think "they're small, so nobody will target them." Instead, the organization looks like a target that is easy to get into and easy to pressure for money once its systems are stopped. Simply checking these points against your own situation will help you sort out the priorities of your security measures.
How serious ransomware damage is: the reality of costs and recovery time
In the NPA's commentary on its statistics, more than 50% of cases of ransomware response involved recovery costs of 10 million yen or more, and it also shows examples where costs climbed even higher depending on the situation. (Reference: NPA Cyber Affairs Bureau, "Threats in Cyberspace in the First Half of 2025")
Recovery costs balloon because the work does not end with restoring systems. For example, root-cause investigation (forensics), external vendor support fees, emergency alternative operations, explanations to internal and external stakeholders, and lost profits from business disruption all pile up at the same time.
Another reality that is easy to overlook is that paying the ransom does not guarantee a resolution.
Even in large overseas cases, there are reports that data was not fully restored despite paying the ransom, and that secondary damage (data leaks and concerns about re-intrusion) remained after recovery. Paying the ransom is not "the end"; if anything, it can be the start of a different set of risk decisions.
15 Ransomware Incidents in Japan (2026 Update)
Below, we present 15 cases of ransomware damage that actually occurred in Japan. The points to check are "what stopped, what leaked, and how much time and money it took."
Let's look at the reality and seriousness of ransomware damage.
KADOKAWA / Dwango (June 2024)
The prolonged outage of Niconico affected not only the video service but also spread to surrounding businesses such as publishing and e-commerce. KADOKAWA disclosed its expected losses in stages and also announced a revision to its estimated extraordinary loss (a downward revision from the initial estimate). (Reference: Dwango Co., Ltd., "Report and Apology Regarding the Cyberattack on Our Services")
It is a representative example in which the scale of the damage suddenly became visible because a service close to everyday consumers went down.
Toyota Motor / Kojima Industries (February 2022)
The case in which an incident at a supplier set off a chain reaction that stopped production at Toyota's plants in Japan showed plainly how frightening supply chain risk can be.
Kojima Industries Corporation's investigation report lays out how an intrusion from outside came to affect operations. The important point here is that you cannot simply say, "We've strengthened the parent company's security, so we're safe."
If even one business partner, subsidiary or contractor is breached, critical operations such as production, logistics and ordering can stop.
Supply chain countermeasures require aligning rules, equipment updates and access control standards not just within your own company but across affiliated companies as well.
ASKUL (October 2025)
ASKUL announced a ransomware infection in October 2025 and has since continued to post official updates stating that it is investigating the scope of the impact and working on recovery. (Reference: ASKUL Corporation, "[Important] Apology and Notice Regarding Information Leakage Due to a Ransomware Attack")
In ransomware incidents, the damage becomes especially severe in areas like logistics and shipping, where revenue stops the moment operations stop.
Even if orders are coming in, when the state of "can't ship" and "can't deliver" continues, the workload on the front line snowballs: customer service, returns and redeliveries, and coordination with business partners. That is why, in recovery, rather than trying to bring everything back at once, it becomes important to decide in what order to restore the functions directly tied to shipping (designing priorities).
Asahi Group (September 2025)
Asahi Group officially announced a system failure caused by a cyberattack and explained that it proceeded with investigation and recovery.
What cases like this show is that "being a major company does not make you safe." The larger the company, the more intricately ordering, logistics and internal core systems are interlinked, so even if only one part stops, the impact spreads all at once.
On the ground, shipping adjustments and business partner inquiries increase, and organizing and sharing information also takes time. Moreover, the more you rush recovery, the harder it becomes to confirm "whether things have been restored safely," so it is important to build a structure that pursues business resumption and prevention of re-intrusion in parallel.
Port of Nagoya (July 2023)
At the Port of Nagoya, the container terminal system (NUTS) stopped, disrupting procedures such as moving containers in and out, which had a major impact on logistics. (Reference: Nagoya Harbor Transportation Association, "Report on the Course of the NUTS System Failure")
The investigation report lays out the scope of the impact of the outage and how the response toward recovery proceeded.
With social infrastructure such as ports, it is never just a matter of one organization's operations stopping. Once import and export delays occur, the impact cascades to manufacturing, retail and even the regional economy.
That is why, in reality, such infrastructure easily becomes a target that lets attackers maximize political and economic impact. Preparing a BCP in peacetime, including recovery procedures and alternative operations, is important.
Osaka General Medical Center (October 2022)
This is a case in which critical systems at Osaka General Medical Center, including electronic medical records, were affected and, as a result, a long recovery effort was required. (Reference: Osaka General Medical Center, "About the Incident Investigation Report")
The investigation report lays out the decisions behind the response after the incident and what became challenges on the way to recovery. What is particularly difficult for healthcare organizations is that "just getting things back as fast as possible" is not enough.
As long as you resume patient care, there remains a risk of recurrence unless you confirm whether the restored environment is truly safe; in other words, whether the entry point has been closed and any traces or persistence left by the attackers have been removed. Ensuring the safety of the restart (eliminating re-intrusion) in parallel with recovery becomes the most important issue.
Tsurugi Town Handa Hospital (October 2021)
This is a case at Tsurugi Town Handa Hospital in Tokushima Prefecture in which a ransomware infection made electronic medical records, billing and other systems unusable, severely affecting patient care. (Reference: Tsurugi Town Handa Hospital, "About the Investigation Report of the Expert Panel on the Computer Virus Infection Incident")
The report cites a VPN device vulnerability that had been left unaddressed (for example, delayed updates to a Fortinet device) as one of the causes. The point to keep in mind here is that "it is not only large hospitals in big cities that are targeted."
Even small and medium-sized hospitals in rural areas become "easy targets" in the eyes of attackers if updates and management of remote access devices are put off.
Okayama Psychiatric Medical Center (May 2024)
At Okayama Psychiatric Medical Center, a ransomware cyberattack on Sunday, May 19, 2024 caused a failure of its integrated information system, including electronic medical records, and the center explained matters such as the possible leak of patient information (up to about 40,000 people). (Reference: Okayama Psychiatric Medical Center, "About the Leak of Patient Information")
Healthcare organizations in particular are an area where damage easily becomes serious, because the response tends to drag on to include not only system recovery but also explanations to patients and stakeholders and putting together measures to prevent recurrence.
We cover ransomware incidents at healthcare organizations in detail in the following article.
7 Ransomware Attacks on Japanese Hospitals (2026 Update): Causes, Defenses and Recovery Costs
HOYA Group (2024)
On March 30, 2024, HOYA Group's systems were hit by a cyberattack. (Reference: HOYA Group, "About the External Leak of Personal Information Due to a Cyberattack") The impact on production, including at overseas sites, was widely discussed, and outside analyses pointed out that the scale of losses could become large.
What is especially important in cases at global companies like this is that recovery can quickly become complicated.
It is not over once the factories are back; multiple systems, including logistics, ordering, inventory, accounting and authentication infrastructure, are connected across countries and sites.
If one part is down, operations as a whole may not run even if other sites are working.
Moreover, recovery priorities involve many decisions, such as "which site should be restored first" and "how to run alternative operations," and delays in decision-making lead to the impact spreading.
That is why it is important to have an overall design (an inventory of interdependencies and recovery procedures) in place in normal times.
Mino Kogyo (October 2025)
At Mino Kogyo, unauthorized access by a third party was confirmed between October 1 and October 4, 2025. (Reference: Mino Kogyo, "[Important Notice] Report on the Possible Leak of Personal Information")
In its official announcement, the company laid out in chronological order the sequence abuse of an employee VPN account → abuse of administrator privileges → encryption and data theft. It also mentions roughly 300 GB of unauthorized traffic, suggesting that the attack was not "encrypt and done" but likely premised on taking data out.
This case made clear the danger of thinking about ransomware countermeasures only in terms of "patching VPN device vulnerabilities."
Even if the device itself has no holes, credentials (IDs and passwords) can become an entry point if they are misused, so operational weaknesses in account management, MFA, least privilege and log monitoring can prove fatal.
You need to review entry points not just as "devices" but including "authentication" as well.
Iseto (2024)
Iseto has made phased announcements on multiple occasions about the ransomware incident and the possibility of a data leak. (Reference: Iseto Corporation, "About the Occurrence of Ransomware Damage")
Continuous updates like these show the reality that identifying the scope of impact and investigating it do not end in one pass.
Furthermore, materials from the Personal Information Protection Commission (PPC) set out the number of people affected and the outsourcing structure, such as clients and subcontracting, on a larger scale, making it concrete "how far the damage spreads when an outsourcing business is hit."
What deserves attention here is that when a contractor (BPO, printing, mailing, data processing and so on) is attacked, the client bears responsibilities such as explanations to customers and regulators, handling inquiries and presenting measures to prevent recurrence, even if the client itself was not directly breached.
Countermeasures must be designed to cover not only your own company but also contractor management (requirements, audits, contracts and operational checks).
Nidec Instruments (May 2024)
Nidec Instruments has published information about its ransomware incident. (Reference: Nidec Corporation, "Occurrence of a Security Incident at a Group Company")
The reason ransomware attacks on manufacturers cause such serious damage is that system failures do not stay "an IT department problem" but tend to directly affect operations.
When factory management systems, ordering, inventory or logistics stop, you end up in a state where the line is running but you cannot ship, or cannot operate safely.
That is why, in recovery, simply restoring the data is not enough.
Before restarting, you need to confirm that the entry point really has been closed, reorganize privileges, put a log monitoring system in place, and rebuild backups into "a form you can restore from even if you are targeted next time."
It is important not to separate recovery from prevention of recurrence, but to pursue them at the same time.
SME manufacturers (typical pattern: the reality read from the statistics)
Even at SMEs whose names are not made public, a sequence of "core server encrypted → ordering and accounting stop → recovery costs balloon" is not unusual on the ground.
NPA statistics and commentary also show a tendency for recovery costs to run high.
At SMEs, the systems supporting the business are often run by a "small, elite" setup, and the structure is such that if any one of, for example, the core server, shared file server or authentication infrastructure stops, operations across the whole company easily stop in a chain reaction.
In other words, having "few assets that can be stopped" means, conversely, having "few escape routes when they are stopped."
That is why preparing a recoverable backup design and alternative operations, alongside entry-point measures (VPN and authentication), becomes a management-level issue.
Colonial Pipeline, United States (May 2021)
In the United States, Colonial Pipeline, a pipeline operator responsible for fuel supply, was hit by ransomware and forced to shut down operations, and as a result the impact extended across social infrastructure as a whole.
News reports also pointed out the impact of the shutdown and how important fuel supply is to daily life and industry.
What is easy to see here is that when an infrastructure business is attacked, the damage does not stay "one company's loss."
It can spread to logistics, prices and the foundations of regional life, widening the disruption. In other words, it is a case showing that in the infrastructure domain, ransomware is not just cybercrime but can become a national-level risk (affecting security and the economy).
US healthcare (UnitedHealth / Change Healthcare, 2024)
The attack on Change Healthcare spread beyond healthcare providers to surrounding functions such as pharmacies and insurance claims processing, creating a situation in which the very "flow" of healthcare could have stopped.
UnitedHealth Group officially updated its recovery status and explained the restoration of its main systems.
News reports also said, based on the CEO's testimony, that a ransom payment (US$22 million) had been made.
Because healthcare is an area where "stopping it has consequences," it is easily targeted regardless of country or organization size, and this case supports the reality that it is a target worldwide.
For how victim companies recovered, please refer to the following article.
How to Recover from a Ransomware Attack (2026): Costs, Timelines and Success Rates
The Latest Ransomware Trends Seen in These Incidents
When you line up the cases, you can see that attackers are not using bizarre new tactics from scratch every time, but repeating "winning plays" that tend to succeed.
That is why the better you understand recent trends, the more clearly you can sort out "what to close off first" and "where to invest," and the less your countermeasure priorities will waver.
The rise of "targeted ransomware"
Rather than the type that is sprayed indiscriminately, recent ransomware is mainly "targeted": attackers map out a company's public information, business relationships and IT assets exposed to the outside, then aim and break in.
A key feature is that they do not encrypt right after getting in. First they move laterally inside the network, steal privileges and take control of core systems such as Active Directory (AD: a tool that centrally manages resources within a company or organization), blocking off "escape routes."
Then they move on to encryption and extortion at the moment that is most inconvenient for the company, such as month-end closing, busy seasons or peak factory operations. Cases like Mino Kogyo, which published the sequence from intrusion to privilege abuse to encryption and data theft in chronological order, are a clear reference for understanding this flow as reality.
The rise of RaaS, the "subscription" model of cybercrime
RaaS (Ransomware as a Service) is a division-of-labor business model in which the ransomware developers provide "a complete toolkit for attacks," and the operators who use it (affiliates) handle the intrusion and execution.
What makes this troublesome is that it lowers the barrier to attack. Because attacks can be run "as long as you can get in" without advanced development skills, the number of attackers grows and the same techniques are easily reproduced in large volumes in a short time.
Moreover, because successful "templates" are shared, victims increasingly find themselves "hit by a similar pattern." This structure has been discussed as the background to large-scale incidents at the Port of Nagoya and in the healthcare sector, so it needs to be understood not as isolated incidents but as a mechanism that can keep producing them.
More sophisticated attacks abusing generative AI and ChatGPT
With the spread of generative AI, the text of phishing emails has become surprisingly natural. In the past, many people could spot them through oddities such as "strange Japanese" or "broken honorifics," but that no longer works so easily.
In other words, training and email drills premised on "unnatural wording" alone now let more attacks slip through. In addition, attackers mimic subject lines and phrasing common in business, such as invoices, delivery notices and account confirmations, so judgment wavers most during busy hours.
That is why countermeasures should not rely on training alone, but be built on both technical and operational measures: email authentication (SPF/DKIM/DMARC), attachment controls, URL isolation and inspection, thorough MFA and a well-defined reporting flow.
Expanding attack routes that target the supply chain
As the Toyota / Kojima Industries case and cases at healthcare organizations where intrusion via a contractor was suspected show, for attackers it is more rational to get in through relatively weaker points than to "strike the well-defended main company head-on."
Business partners, subsidiaries and contractors often cannot maintain the same level of staffing, budget and monitoring, so delayed VPN updates, incomplete MFA and lax account management tend to become entry points.
In addition, if backups remain attached to the network, the risk that they will be encrypted along with everything else after an intrusion also rises.
If even one company still has such weaknesses, the impact can spread to the main company's ordering, production or patient care, and a situation where "our operations stop even though we weren't directly breached" can occur. That is why thinking in terms of aligning a minimum level of countermeasures across the entire supply chain is essential.
"Double extortion": encryption plus exposure
Even if your backups are in order and you can recover from encryption, with recent ransomware "that's the end of it" no longer applies.
If data was taken out beforehand, attackers can keep up the extortion by threatening to "publish it" or "contact your business partners," so the risk of a data leak remains.
As the contractor incident (Iseto) and the healthcare cases show, what weighs heaviest in practice is not just the recovery work but the tendency for tasks such as identifying the scope of impact, notifying stakeholders, issuing apologies, setting up inquiry desks, reporting to regulators and explaining measures to prevent recurrence to drag on.
In other words, while backups are an important "means of recovery," they do not automatically resolve leak response. With this as a premise, you need to prepare the structure and procedures in normal times.
The 5 Main Ransomware Infection Routes
Ransomware countermeasures start with understanding "where they get in."
Closing the entry points first tends to be more effective than blindly adding more tools.
NPA materials also show a tendency for VPN devices and Remote Desktop (RDP) to account for a large share of entry points.
If your company uses VPN or RDP, they are worth reviewing as a top priority.
1. VPN device vulnerabilities (among the most common)
According to NPA materials (2025), intrusion through VPN and remote desktop devices accounts for more than 80% of all ransomware infection routes.
In other words, if you are prioritizing entry-point measures, it is rational to start with VPN.
With the spread of remote work, using VPNs has become a given, but on the other hand there are many cases where firmware updates and EOL (end of life) handling have not kept up.
VPN devices tend to be run on a "install once and use for a long time" basis, and it often happens that by the time anyone notices, updates had stopped.
From the attacker's point of view, such "entry points that never get updated" are clear targets, and as a result VPNs are targeted again and again.
2. Via Remote Desktop (RDP)
The same NPA materials show that RDP (Remote Desktop) also accounts for a large share of entry points and, together with VPN, is at the center of intrusions.
RDP is convenient operationally, but left exposed to the outside it becomes an obvious entry point for attackers.
Especially dangerous are cases where conditions such as password reuse, short passwords and no MFA overlap.
Add settings such as "exposed even though it isn't actually needed" or "no source restrictions," and the risk of being breached starting from brute force or leaked credentials shoots up.
If you use RDP, you need to treat minimizing exposure, MFA, strong authentication, source restrictions and proper monitoring logs as a set.
3. Phishing emails and targeted attacks
Emails disguised as invoices or delivery notices are still a staple, and what makes them troublesome is how easily they blend into daily work.
Moreover, because of generative AI, they are harder to filter out based only on the old sense that "the Japanese is strange, so it's suspicious."
When both the subject and body are natural and written in a tone close to internal communications, judgment dulls most during busy hours. Recently, rather than sending dangerous attachments, techniques have increasingly shifted toward luring people to a login page to steal their IDs and passwords.
Once credentials are stolen, attackers can log in legitimately to VPNs and cloud services, making intrusion possible even without device vulnerabilities. It is important to design email countermeasures that go beyond "don't open it" to include MFA, URL inspection and a well-defined reporting flow.
4. Supply chain attacks
A supply chain attack uses contractors, subsidiaries or business partners as a stepping stone to extend the impact to the organization that is the real target.
From the attacker's perspective, the calculation is that getting in through peripheral companies, where countermeasures tend to be relatively weaker, has a higher success rate than striking the well-defended main company head-on.
As the Toyota and healthcare cases show, what is frightening is "stopping even though your own company was not directly breached." The more an operation depends on coordination, such as ordering, production or patient care, the more a failure at any one company cascades and stops the entire business.
That is why, including contracts and organizational structure, you need to align a minimum level across the entire supply chain, covering contractor security requirements, access privileges, VPN and authentication operations and backup design.
5. Website tampering (watering hole attacks)
Also called a "watering hole attack," this is a type in which a legitimate website is tampered with and infection spreads when people view it or download from it.
Rather than tricking users, the attacker targets "people who routinely visit because they trust the site" all at once.
In some cases, ad delivery or external scripts are abused, and users fall victim without noticing.
Endpoint protection on the user side (OS and browser updates, EDR/AV, removing unnecessary plugins) is not enough on its own.
Site operators also need a setup that "doesn't get tampered with, or notices quickly if it does," including CMS and plugin updates, privilege management, WAF deployment, file tampering monitoring and log monitoring. This is a point to review, including the risk of your own site being used as a stepping stone.
How to Prevent Ransomware Damage
If you try to perfect every ransomware countermeasure from the start, you tend to run out of capacity and stall.
What matters is deciding "what to tackle first" based on entry-point statistics (VPN and RDP being common, for example) and the failure patterns actually happening in the field.
Once priorities are set, even with a limited budget and staff you can make steady progress in the order that delivers results.
[Top priority] Countermeasures for VPN and network devices
As long as VPN and remote access are at the center of intrusions, leaving them unaddressed is dangerous.
Email drills and awareness campaigns are of course necessary, but if the entry point is left open, attackers do not even need to trick anyone.
The top priority is to realistically close off the routes that can be reached from outside.
- Update firmware and check EOL status of VPN, firewall and remote access devices (an unsupported device is itself "the risk of being unable to update")
- Make MFA mandatory wherever possible (take inventory of any remaining exceptions and reduce loopholes)
- Reduce external exposure (reduce exposure of unnecessary admin screens and VPN portals to shrink the attack surface)
- Regular vulnerability assessments to close "the holes attackers see" first (it is important to run the full cycle of discovery → fix → reverification)
Covering just these four points can realistically lower the probability of intrusion.
Building a backup system
The essence of backups is not "whether you have them," but whether they can actually be used for recovery.
In ransomware incidents, there are cases where the backups themselves are encrypted, or where restoration procedures are vague and staff cannot act, so in the end nothing can be restored.
That is why the mechanism and its operation must be put in place as a set.
- Use 3-2-1 (3 copies / 2 types of media / 1 offsite) as the baseline
- Where possible, adopt offline (isolated) or tamper-resistant (immutable) storage
- Run restore tests regularly (untested backups may not work when you need them)
You can only say "we're fine because we take backups" once you have confirmed you can actually restore from them. Once this is solid, you are much less likely to be pushed around by attackers' extortion.
Employee training and security awareness
Training is important, but unfortunately it is not a cure-all.
That is why it should not end at "how to spot suspicious emails," but be designed as operational rules that can be built into daily work.
- Rules for receiving email (checks before clicking a link, how to handle attachments)
- Thorough enforcement of no shared accounts / password management / MFA
- Reporting flow (whom to contact, with what, in what order)
With these three in place, people can act without hesitation in a near-miss moment, making it easier to contain the spread of damage.
Reviewing access privileges
Enforcing least privilege (PoLP) makes lateral movement (privilege escalation and moving within the network) difficult even if an intrusion does occur, making it easier to limit the scope of damage. It is realistic to start with these three points:
- Stop using administrator privileges routinely (elevate only when needed)
- Restrict access to AD and critical servers (minimize who can access and through which routes)
- Reliably remove privileges when people leave or change roles (make inventory reviews a regular routine)
The trick is to prioritize "a system that doesn't stop" over "convenience."
Deploying security tools
Traditional antivirus (AV) is an important foundation, but it cannot necessarily stop recent attacks on its own.
Ransomware often steals privileges after intrusion, moves laterally inside the network, lies dormant for a while and then switches to encryption and theft all at once, so there are situations where "detect the executable and you're done" cannot keep up.
That is where mechanisms such as EDR (Endpoint Detection and Response), which monitors behavior on endpoints, detects anomalies and can even isolate them, are worth considering.
However, tools have no effect just by being installed. Who looks at the alerts, what happens on holidays and at night, how far endpoints can be isolated when something is detected: it is important to decide the post-deployment operational design as a set. Only once it is put into a form that actually runs does it become the power to "detect and stop."
Emergency response if you are infected (5 steps)
The scariest thing in incident response is the damage spreading while you hesitate, wondering "what should we do?"
The later the decision, the more the scope of encryption and data exfiltration expands and the harder recovery becomes.
At a minimum, be ready to act in the following order:
- Disconnect from the network (to prevent spread: unplug the LAN cable, turn off Wi-Fi, etc.)
- Be careful about powering off (because of evidence preservation and the possibility of making things worse, as a rule consult an expert)
- Contact the person in charge internally and external experts (a delayed initial response can decide whether recovery succeeds)
- Consult or report to the police and relevant agencies (depending on the situation, consider including IPA and others)
- Recover (proceed while checking restore points, cutting off re-intrusion routes and including restore tests)
Also, paying the ransom is generally not recommended. Even if you pay, you may not fully recover, you may be extorted again, and legal and sanctions risks may be involved.
When a decision is required, it is important to work with legal, the police and experts and to proceed on a sound basis.
We have summarized protection software for preventing damage in the article below.
Best Ransomware Protection Software Compared (2026): A Guide for Individuals and Businesses
For Ransomware Defense, CyberCrew's Vulnerability Assessments and Penetration Testing
By now, the question of "where should we start, after all?" should be much clearer.
In conclusion, as long as the main battleground for intrusion is VPN and remote access, it is not wise to spread your efforts to other countermeasures while leaving that unaddressed.
Identifying "the holes they can get through" from the attacker's perspective first, then closing them in order of priority, is the most cost-effective preventive measure, one that tends to deliver results even on a limited budget.
Why vulnerability assessments and penetration testing work as ransomware countermeasures
Rather than simply a virus getting in and "infecting" you, ransomware is in reality an attack whose damage usually comes about through the process
"intrusion → lateral movement → privilege theft → encryption and exfiltration."
Entry points are not just VPNs and public servers; breaches happen through a combination of many factors, such as poor credential management, lax privilege design and misconfigurations.
Vulnerability assessments and penetration testing identify these entry points not as a "checklist" but in the order attackers actually target them, and assign risk levels and priorities in a reproducible way.
For example, they can separate whether "this misconfiguration is a theoretical finding" or "a hole that actually leads to intrusion," making the order of fixes clear.
Features of CyberCrew's vulnerability assessments and penetration testing
CyberCrew has white-hat hackers on staff who, rather than relying only on automated tool results, perform manual verification from the attacker's perspective and prioritize checking "holes that lead directly to intrusion."
For example, we separate "findings that are flagged but unlikely to cause real harm" from "entry points that lead to lateral movement if even one is breached," and present an improvement order grounded in reality.
- What to fix first (priorities): clarify the "order of fixes" based on impact and feasibility
- Risk explanations needed for management decisions (impact and expected scenarios): organize the wording and rationale you can use for internal explanations
- Reverification after remediation (preventing recurrence): prevent "we thought we fixed it" and make improvements stick
We focus on not ending with "a list of findings" but connecting it to improvements that work in practice.
Pricing plans and cost
Costs vary depending on the assessment targets (VPN / public servers / web applications / number of sites and scope) and the depth of the engagement (assessment only / intrusion verification / retesting after remediation).
If you share your current situation (VPN devices, the scope of external exposure, operational status), we can provide a quote starting from the minimum configuration that fits your goals.
Summary: Ransomware Is a Threat That Could Hit You Tomorrow
With 116 cases reported in the first half of 2025 alone, ransomware damage is on the rise.
It is not only large companies being targeted; industries where a single stoppage directly threatens business continuity, such as healthcare, manufacturing, logistics and contractors, are targeted again and again.
In addition, as long as VPN and remote access are the main entry points, entry-point measures (updating devices, enforcing MFA and reducing unnecessary external exposure) should be the top priority.
And with backups, the key is not "whether you have them" but whether they are isolated and whether you run restore tests.
If recovery procedures are vague, you will not be able to restore when it counts, and the damage will drag on. In case the worst happens, build an operation where no one hesitates, following the order disconnect → assess the situation → contact experts → report → recover.
Simply understanding early on "how dangerous our VPN and public-facing assets look from an attacker's perspective" can realistically lower the probability of damage.
