Ransomware

Ransomware is a type of malware that locks or encrypts a victim's data and demands a payment, usually in cryptocurrency, in exchange for restoring access. Many groups also steal data first and threaten to publish it.

Why it matters

Ransomware can halt hospitals, factories and online shops for days. Payment does not guarantee recovery and funds further attacks. The most effective defenses are tested offline backups, prompt patching, MFA on remote access and limiting how far one compromised account can reach.

Recovery cost usually exceeds the ransom itself once downtime, investigation and rebuilding are counted, which is why prevention and backups matter more than any negotiation.

Example

Staff open an invoice attachment, malware spreads through shared drives, and files become report.xlsx.locked. A note demands payment. A company with a recent, offline, tested backup can restore instead of negotiating.

Common mistakes

• Keeping backups on the same network share, where ransomware encrypts them too.
• Never testing restores until an emergency.
• Exposing remote desktop services to the internet without MFA.

Related

• Malware
• Phishing
• Patch
• Least privilege
• Tool: Blacklist checker

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.