Modern ransomware often steals data before encrypting it, so the threat is both "pay to unlock" and "pay or we publish". It usually arrives through a taken-over account, a phishing email or an exposed remote-access tool.
The best outcome is stopping it early: the first process that starts encrypting files, before it spreads to shared drives and other machines. Good backups decide how fast a business recovers.
How Centeye handles it
Centeye Ironwatch spots ransomware early and can stop the process. With your approval it can also cut the machine off the network so it cannot spread.
Ironwatch: endpoint protection →Go deeper: Why SMBs are a ransomware target