TL;DR:

  • Ransomware groups are using AI to write convincing phishing emails, research targets, and automate attacks — the human-in-the-loop is largely gone from the targeting phase
  • UK SMEs are a specific focus because they hold valuable data, often pay ransoms, and typically have weaker defences than enterprises
  • AI-generated lures are now indistinguishable from legitimate business communications without specific technical controls
  • Offline or immutable backups remain the single most effective defence — nothing else gives you the same recovery guarantee
  • NCSC’s Cyber Essentials certification covers the five controls that block most of the technical attack vectors ransomware groups use

Ransomware isn’t new. What’s new in 2026 is the scale and precision with which it targets small businesses, and the role AI is playing in making attacks cheaper to launch and harder to spot.

The fundamental ransomware playbook hasn’t changed: attackers get into your systems, encrypt your files, and demand payment to give you the decryption key. What AI has changed is the reconnaissance and delivery phase — the work that used to require skilled humans researching each target individually. That phase is now largely automated.

How AI Has Changed the Attack

The most visible change is in phishing emails. Legacy ransomware campaigns sent generic emails — “Your invoice is attached,” “Please review this document” — that most people have learned to recognise. The tells were often obvious: odd formatting, slightly wrong sender names, generic language.

AI-generated lures in 2026 are different. Attackers use language models to write emails tailored to your specific business, referencing your actual suppliers, your real industry context, and sometimes even your employees by name. The source material comes from your company website, your LinkedIn presence, your Companies House filings, and anything else publicly available. The result is an email that looks like it came from a supplier you actually use, referencing a transaction that sounds plausible for your business.

A building contractor in Leicester received an email that correctly named their main materials supplier, referenced the type of project they typically work on, and asked them to open an updated price list. The email was AI-generated using publicly available information. The attachment installed ransomware that encrypted files on the business owner’s laptop and the shared network drive where job files were stored.

The second change is in targeting. Ransomware groups used to spray broadly and hit whoever clicked. Now they use AI to pre-screen potential targets, identifying businesses that hold valuable data (accountants, solicitors, healthcare providers, construction companies with project files), that are likely to pay rather than recover from backup, and that appear to have limited IT security. Your public web presence, LinkedIn company page, and job listings are data sources for this screening.

Why UK Small Businesses Are Specifically Targeted

UK SMEs have become a preferred target for several reasons. The UK has a high density of professional services firms — accountants, solicitors, surveyors — that hold sensitive client data and have strong incentives to restore access quickly. UK businesses also tend to have cyber insurance at higher rates than SMEs in some other markets, which tells attackers that payment is more likely (insurance often covers ransom payments, though this practice is increasingly controversial).

The NCSC’s 2026 Cyber Threat Report noted a significant increase in ransomware incidents affecting businesses with fewer than 250 employees. The median ransom demand for UK SMEs was around £45,000, with demands ranging from £5,000 for the smallest businesses to several hundred thousand for larger targets.

Critically, most of these incidents began with a phishing email that successfully deceived an employee — not with a sophisticated technical exploit. The AI-generated lures are doing their job.

The Controls That Actually Work

The good news is that the technical defences against ransomware haven’t fundamentally changed, even as the attacks have become more sophisticated. What’s changed is the urgency of having those defences in place.

Immutable or offline backups. This is non-negotiable. If ransomware encrypts your files, the only reliable way to recover without paying is from a backup that the ransomware couldn’t also reach and encrypt. Cloud backup services that keep version history for 30+ days, or physical backups stored offline (a hard drive kept off-site), give you this. Backups stored on the same network as your primary files — including network drives and NAS devices accessible from infected machines — are not safe.

Email filtering with attachment sandboxing. Modern email security services (Microsoft Defender for Office 365, Proofpoint, Mimecast, and others available to SMEs) run email attachments through a sandbox environment before delivering them, checking for malicious behaviour. This doesn’t catch everything but significantly raises the bar. It’s a significant upgrade over relying on employees to spot malicious attachments.

Multi-factor authentication on everything. Ransomware groups increasingly use stolen credentials to access systems rather than relying solely on malware. If someone’s email password is compromised in a data breach, MFA prevents that from becoming full access to your Microsoft 365 or Google Workspace account. MFA is free in most business email platforms and should be mandatory for all accounts.

Principle of least privilege. If ransomware executes in the context of an employee’s account, it can encrypt everything that account has access to. Limiting which accounts have access to which file shares means a successful attack on one employee doesn’t necessarily encrypt your entire operation.

Patching. Many ransomware groups exploit known vulnerabilities in software — including Windows, your browser, and software plugins — that have patches available but haven’t been applied. Keeping software updated removes these footholds.

The NCSC’s Cyber Essentials certification covers all five of these areas and costs around £300 for self-assessed certification. For businesses working with larger companies or the public sector, it’s also increasingly required in procurement. If your business doesn’t have Cyber Essentials, getting it is the most efficient use of security budget for an SME.

What to Do If You’re Attacked

If ransomware encrypts your files, the immediate priority is containment. Disconnect affected machines from the network immediately — unplug the ethernet cable or disable Wi-Fi — to prevent the ransomware from spreading to other devices. Don’t turn off the affected machine; forensic recovery is sometimes possible with the machine in its current state.

Report to Action Fraud (actionfraud.police.uk) and to the NCSC (report.ncsc.gov.uk). If you have cyber insurance, notify your insurer immediately.

Do not pay the ransom without taking professional advice first. Payment doesn’t guarantee you’ll receive working decryption keys, doesn’t guarantee the attackers won’t release your data anyway, and may create compliance complications depending on your sector and the ransomware group involved.

The NCSC and several UK cyber incident response firms can advise on recovery options. NCSC’s website has a ransomware guidance page, and they maintain a list of assured cyber incident response providers.