A ransomware incident does not need to take down a server room to stop a business. If staff can access shared files through Microsoft 365, OneDrive, SharePoint or a cloud drive, attackers may be able to reach them too. So, can ransomware encrypt cloud files? Yes. The method is often less dramatic than businesses expect, but the operational impact can be just as serious.
For an Irish business relying on cloud collaboration, the real question is not whether cloud files are completely immune to ransomware. It is whether your people, permissions, backups and recovery process can contain an attack before it becomes prolonged downtime.
Can ransomware encrypt cloud files? Yes
Ransomware encrypts data by gaining access to a user account, a device or an administrator account, then changing files so they cannot be opened without a decryption key. Cloud storage does not automatically prevent this. If an attacker has valid access, or has compromised a computer that is synchronising files to the cloud, encrypted copies can be uploaded and replace the usable versions.
A common example involves an employee opening a convincing phishing email. Malware runs on their laptop and encrypts folders that are synchronised with OneDrive or a mapped cloud drive. The sync client then treats those encrypted files as legitimate changes and uploads them. If those folders are shared, colleagues can quickly find that project documents, spreadsheets, drawings and finance records are no longer usable.
Attackers do not always need malware on a device. Stolen Microsoft 365 credentials may let them access SharePoint or OneDrive directly. They may delete files, alter permissions, create forwarding rules to capture further information, or use an account to spread malicious links internally. Where a highly privileged account is compromised, the scope can extend across teams, sites and business systems.
Cloud platforms have strong security capabilities, but they operate on a shared-responsibility basis. Microsoft protects the underlying service and infrastructure. Your business remains responsible for identities, access controls, configuration, user behaviour and the protection of its own data.
Why synchronisation can make an attack spread
Cloud synchronisation is designed for productivity. It ensures a revised proposal on a laptop appears quickly for colleagues in the office, at home or on site. During a ransomware incident, that same convenience can work against you.
When a synchronised file is encrypted locally, the cloud service sees a changed file. Unless a security control detects and interrupts the activity, the encrypted version can be replicated across the shared location. A file that was safely stored in the cloud a few minutes earlier may therefore become inaccessible to everyone who relies on it.
The impact depends on how your environment is set up. A staff member with access only to their own working folder presents a more limited risk than a user with broad access to departmental libraries. Shared service accounts, weak password practices and excessive administrator privileges increase the potential damage considerably.
This is why access should be based on what each person genuinely needs to do their job. It can feel easier to grant everyone access to everything, particularly in a smaller organisation. However, sensible separation of finance, HR, management and operational data limits the blast radius when an account or device is compromised.
Are version history and recycle bins enough?
Version history and recycle bins are valuable recovery features, and they can be extremely useful after accidental deletion or a small-scale ransomware event. In Microsoft 365, previous versions of files may be restored, while deleted content may remain recoverable for a defined period. These features should be understood and used.
They are not, however, a complete ransomware recovery strategy. Retention periods are finite, and an attacker with sufficient access may try to delete data, versions or recovery points. Large-scale encryption can also create thousands of changed files, making restoration slow and difficult to manage. Your team may need to establish precisely when the attack began and identify a safe point to recover from.
There is also a practical distinction between being able to recover a file and being able to resume normal operations. If the business needs to restore several SharePoint libraries, validate permissions, re-secure affected accounts and check endpoint devices before allowing staff back in, recovery requires planning and expertise.
A separate backup of Microsoft 365 and other critical cloud data provides an additional layer of protection. The most useful backups are protected from routine user access, monitored for successful completion and tested regularly. Immutable backup options, where recovery data cannot be altered or deleted for a set period, can offer valuable protection against attackers attempting to remove your route back.
The controls that reduce cloud ransomware risk
There is no single setting that eliminates ransomware. Effective protection combines preventative controls with the ability to recover quickly when something gets through.
Multi-factor authentication should be enabled for all users, with particular care around administrators and remote access. A password alone is too easily stolen through phishing, password reuse or malicious software. Conditional access policies can add useful checks, such as requiring stronger authentication for unfamiliar locations or blocking sign-ins that present a clear risk.
Endpoint protection is equally important. Laptops and desktops remain a frequent entry point, especially for hybrid teams. Managed detection, patching and security monitoring help identify suspicious behaviour, isolate a compromised machine and investigate what the attacker accessed. This needs to cover devices wherever staff work, not just equipment connected to the office network.
Email security and staff awareness matter because many attacks start with a message that appears routine: an invoice, a shared document, a delivery notification or a request from a senior colleague. Training should be practical and repeated. Staff need to know how to question unexpected requests, report suspicious messages promptly and avoid trying to solve a possible security incident alone.
For most organisations, the priority controls are:
- multi-factor authentication and tightly controlled administrator accounts;
- managed endpoint protection, operating system updates and prompt patching;
- sensible permissions for SharePoint, OneDrive and other shared cloud storage;
- separate, monitored backups with tested restore procedures; and
- an incident response plan that gives staff a clear route to report a problem.
These measures work together. Backups are essential, but they do not stop an attacker from accessing sensitive information. Multi-factor authentication is valuable, but it will not correct overly broad file permissions. Good security is a set of connected decisions, maintained over time.
What to do if you suspect cloud files are being encrypted
Speed matters. If a user sees unfamiliar file extensions, ransom notes, large numbers of files changing names or alerts about unusual sign-ins, treat it as a potential security incident. Do not continue working in affected folders in the hope that the problem will settle down.
Disconnect the suspected device from the network and internet where possible, but do not switch it off unless instructed by your IT provider or incident response team. Shutting down or attempting a clean-up can remove evidence needed to understand the attack. Report the issue immediately so access can be investigated, accounts can be secured and synchronisation can be stopped where appropriate.
The next steps should include resetting affected credentials, revoking active sessions, checking administrator accounts and reviewing recent sign-in activity. Your IT team should establish which files, users, devices and services were affected before restoring data. Restoring too early, without removing the cause, can reintroduce the ransomware or allow the attacker to continue working in the environment.
Communication is also an operational issue. Staff need clear instructions on what to do and which systems are safe to use. If customer, financial or personal data may have been accessed, the business may have legal and reporting responsibilities. Specialist advice may be required to assess the facts and manage communications properly.
Recovery should be a business decision, not an improvised task
A recovery plan should reflect how your organisation actually works. A construction firm may need access to current drawings and site documentation first. A professional services business may prioritise client records, email and case files. Finance teams may need payroll, banking and accounting systems restored within hours. The right recovery order is not always the same as the order in which data was backed up.
This is where testing makes the difference. A backup that has never been restored is an assumption, not a proven recovery capability. Regular tests should confirm that data is complete, accessible and recoverable within an acceptable timeframe. They should also test who makes decisions, who communicates with staff and how alternative working arrangements will operate during disruption.
For businesses without a large internal IT team, ongoing monitoring and a documented response process can turn a confusing incident into a controlled one. LANCAST helps organisations put practical protections, backup arrangements and recovery planning around the Microsoft 365 and cloud services they depend on, so security supports continuity rather than becoming another management burden.
Cloud files give teams the flexibility to work from anywhere. Protecting them properly means treating identity, devices, permissions and backup as part of the same service – and testing your ability to recover before you ever need it.