Ransomware
Ransomware is a type of malicious software that encrypts your files — essentially locking them — and then demands you pay a ransom to get them back.
It can affect individuals, businesses, hospitals, and even governments. The best protection is keeping regular backups of your important files and not clicking on suspicious links or attachments.
Ransomware, explained at three levels
At home
Ransomware is like a digital kidnapper for your files. It sneaks onto your computer, locks all your photos, documents, and other files, and then shows a message demanding money to unlock them. The best defense is keeping backups of your important files so you never have to pay.
At work
For businesses, ransomware is one of the most disruptive and costly cyber threats. An attack can halt operations entirely, as employees lose access to critical files and systems. Organizations defend against ransomware with regular backups, network segmentation, endpoint protection, and incident response plans.
At home
Ransomware typically arrives through phishing emails, malicious websites, or exploited vulnerabilities. Once it runs on your system, it encrypts your files using strong cryptography and displays a ransom note, usually demanding payment in cryptocurrency. Paying the ransom is discouraged because there's no guarantee you'll get your files back.
At work
At a professional level, ransomware defense involves implementing the 3-2-1 backup strategy, deploying endpoint detection and response solutions, and maintaining an incident response plan. Organizations also use network segmentation to prevent ransomware from spreading laterally and may purchase cyber insurance to mitigate financial impact.
At home
Advanced users understand that modern ransomware often involves double extortion — attackers steal sensitive data before encrypting it and threaten to publish the data if the ransom isn't paid. Maintaining encrypted, offline backups and minimizing the amount of sensitive data stored locally are key personal defenses.
At work
Enterprise-level ransomware response involves forensic analysis to determine the attack vector, scope assessment to identify affected systems, coordination with law enforcement, and decisions about recovery strategies. Advanced ransomware operations function as organized crime businesses with customer support portals, negotiation teams, and affiliate programs.
Real-world examples
At home
Derek turned on his laptop one morning to find all his family photos and tax documents locked behind a ransom screen demanding $500 in Bitcoin. Because he had been backing up his files to an external drive weekly, he was able to wipe his computer and restore everything without paying.
At work
Sandra, the operations director at a regional hospital, faced a ransomware attack that encrypted patient scheduling systems. Thanks to the IT team's regular offline backups and rehearsed incident response plan, the hospital restored operations within 12 hours without paying the ransom.
Common confusions
- Many people assume paying the ransom guarantees you'll get your files back. Many victims who pay never receive a working decryption key.
- It's a common myth that ransomware only targets large companies. Individuals, small businesses, schools, and hospitals are frequent targets.
- It's easy to assume antivirus software alone will stop ransomware. Modern ransomware can evade basic antivirus, making backups essential.
For analysts
Business analysts should include ransomware scenarios in business continuity planning and requirements. When defining data management requirements, specify backup frequency, recovery time objectives, and offline storage needs. Understanding ransomware risk helps ensure that project requirements include appropriate resilience measures.
History & origin
The first known ransomware, the AIDS Trojan, appeared in 1989 and was distributed via floppy disks. Modern ransomware exploded in popularity around 2013 with CryptoLocker, and high-profile attacks like WannaCry in 2017 demonstrated how ransomware could cripple organizations worldwide.