In 2025, Colombia ranked as the third most ransomware-attacked country in Latin America, behind Brazil and Mexico. The average cost of a successful attack in the region exceeded USD 1.2 million, including downtime, recovery, and reputational damage.
The bad news: attackers no longer only target large corporations. SMBs are an increasingly frequent target precisely because they invest less in security.
How Does a Ransomware Attack Work?
A typical attack follows this pattern:
- Initial access: the attacker enters the network through a phishing email, stolen credentials, or an unpatched vulnerability
- Reconnaissance: moves silently through the network for days or weeks, identifying critical systems
- Exfiltration: copies the most sensitive data before encrypting it (double extortion)
- Encryption: locks files and systems, making the company inoperable
- Ransom: demands payment in cryptocurrency, typically between USD 50,000 and USD 2,000,000
The 3 Most Common Entry Points
1. Email Phishing 82% of attacks start with a malicious email. The employee clicks a link or opens an attachment that installs silent malware. Modern phishing emails are extremely convincing — they can mimic invoices from real vendors, bank notifications, or WhatsApp messages.
2. Compromised Credentials Weak or reused passwords leaked in previous security breaches. Attackers buy these credentials on dark web markets and systematically test them against remote access portals (VPN, RDP, Office 365).
3. Unpatched Vulnerabilities Outdated software with known vulnerabilities. The average time between patch publication and mass exploitation is just 15 days.
7 Concrete Protective Measures
1. Multi-Factor Authentication (MFA) on all accesses — blocks 99.9% of compromised credential attacks according to Microsoft.
2. Backups with the 3-2-1 rule — 3 copies of data, on 2 different media, 1 offsite (disconnected from the main network). Test restoration at least every 3 months.
3. Network segmentation — if one segment is compromised, ransomware can't spread freely throughout the infrastructure.
4. Automated patch management — operating systems, applications, and firmware must be updated within 72 hours of a critical patch being published.
5. Phishing awareness training — quarterly awareness training and phishing simulations for all employees.
6. Continuous monitoring (EDR/SIEM) — endpoint detection and response tools that identify anomalous behavior before encryption begins.
7. Incident response plan — a documented and practiced playbook before an attack occurs reduces recovery time by 60%.
At Datandina we offer cybersecurity audits and remediation plans adapted to your company's size and budget. Contact us before the incident occurs.