In 2021, Virginia's state IT agency (VITA) was hit by a ransomware attack that disrupted services for multiple state agencies and triggered a $300 million legal dispute. In 2023, a ransomware attack on a major managed service provider (MSP) cascaded to affect over 1,500 of its clients simultaneously.
Ransomware attacks on IT agencies are not just a threat to the agency itself — they're a threat to every client the agency serves. Understanding how these attacks work and how to prevent them is essential for every IT agency in 2025.
How Ransomware Attacks on IT Agencies Work
A typical ransomware attack on an IT agency follows this pattern:
- Initial access: The attacker gains entry through a phishing email, exploited vulnerability, or compromised credentials. Remote Desktop Protocol (RDP) and VPN vulnerabilities are common entry points for IT agencies.
- Lateral movement: Once inside, the attacker moves through the network, escalating privileges and mapping the environment. This phase can last weeks or months before the ransomware is deployed.
- Data exfiltration: Before encrypting files, sophisticated attackers steal sensitive data — client records, source code, credentials — to use as additional leverage ("double extortion").
- Ransomware deployment: The attacker deploys ransomware across the network, encrypting files and systems. For IT agencies with remote access to client systems, the ransomware may spread to client environments simultaneously.
- Ransom demand: The attacker demands payment (typically in cryptocurrency) in exchange for the decryption key and a promise not to publish stolen data.
Why IT Agencies Are Particularly Vulnerable
- Remote access tools: IT agencies use RDP, VPN, and remote management tools to access client systems. These tools are prime targets for attackers.
- Privileged access: IT agencies often have admin-level access to client systems — making them a high-value target.
- Supply chain leverage: Compromising one IT agency can provide access to dozens or hundreds of client organisations simultaneously.
- Security investment gap: Many IT agencies invest heavily in security for their clients but neglect their own internal security posture.
The irony: IT agencies that sell cybersecurity services to clients are sometimes the least secure organisations themselves. "We're too busy securing our clients to secure ourselves" is a dangerous mindset that attackers actively exploit.
Essential Ransomware Prevention Measures for IT Agencies
1. Multi-Factor Authentication (MFA) — everywhere
MFA is the single most effective control against ransomware attacks that begin with credential theft. Implement MFA on all remote access tools (RDP, VPN, remote management platforms), email, and cloud services. No exceptions.
2. Privileged Access Management (PAM)
Implement a PAM solution to control, monitor, and audit all privileged access — both internal and to client systems. Ensure that admin credentials are unique per client and rotated regularly.
3. Network segmentation
Segment your network so that a compromise in one area can't spread to all systems. Critically, ensure that your internal network is segmented from client access networks.
4. Endpoint Detection and Response (EDR)
Deploy EDR on all endpoints — not just antivirus. EDR solutions can detect and respond to ransomware behaviour in real-time, often stopping an attack before it can encrypt significant data.
5. Immutable backups
Maintain offline, immutable backups that can't be accessed or encrypted by ransomware. Test your backup restoration process regularly — a backup you've never tested is not a backup.
6. Patch management
Keep all systems, software, and remote access tools patched and up to date. Many ransomware attacks exploit known vulnerabilities for which patches are available.
7. Security awareness training
Phishing is the most common initial attack vector. Regular security awareness training and simulated phishing exercises significantly reduce the risk of successful phishing attacks.
Incident Response Planning
Despite best efforts, no organisation is immune to ransomware. Having a tested incident response plan is essential:
- Define roles and responsibilities for incident response
- Establish communication protocols (who to notify, when, and how)
- Document your backup restoration procedures
- Identify your cyber insurance coverage and claims process
- Establish relationships with a cybersecurity incident response firm before you need them
- Practice your incident response plan with tabletop exercises at least annually
avg. ransomware attack cost (2023)
of organisations hit by ransomware in 2023
avg. downtime after ransomware attack