Ransomware
Also known as: ransom malware, crypto-ransomware, file-encrypting malware, double extortion
Ransomware is malicious software that locks up your files by encrypting them, then demands a ransom (usually in cryptocurrency) to restore access.
For a small business, an attack can halt operations for days, and paying the ransom offers no guarantee your data comes back.
Ransomware, explained at three levels
At home
Picture a burglar who doesn't steal your filing cabinet but snaps a padlock on it and leaves a note demanding money for the key. Ransomware works the same way. A malicious program, usually arriving through an email attachment or a bad link, scrambles your files with encryption so they look like gibberish, then displays a ransom note offering the key in exchange for payment, usually in cryptocurrency.
At work
Ransomware is malicious software that encrypts a company's files and systems, then demands payment for the decryption key. Because it spreads across shared drives and servers, one infected laptop can stop invoicing, scheduling, and email for the whole business. Most groups now also steal data first and threaten to publish it, so a business faces both downtime and a possible privacy breach.
At home
An attack has a few stages. First the program gets in, through a phishing attachment, a fake software download, or a stolen password. Next it searches the computer and any connected drives for documents, photos, and backups. Then it encrypts each file with a key only the attacker holds and leaves a ransom note. Without that key, the files cannot be unscrambled, which is why a separate backup the ransomware could not reach is the real way back.
At work
In a business, ransomware is usually the last step of a longer intrusion. Attackers get in through phishing, a stolen remote-access password, or an unpatched VPN or firewall. They then spend days or weeks moving between machines, gaining administrator rights, deleting or encrypting backups, and copying data out. Only then do they launch encryption everywhere at once. Most attacks come from ransomware-as-a-service groups, where developers rent their tools to affiliates who carry out the break-ins.
At home
Ransomware uses hybrid encryption. Each file is scrambled with a fast symmetric cipher such as AES, and that file key is then locked with the attacker's public RSA key, so only their private key can undo it. Many strains also delete Windows shadow copies to remove easy restores. While paying sometimes produces a working decryptor, it is often slow and partial. In my view, an offline backup is the only recovery plan worth trusting.
At work
Mature defence assumes attackers will get in and limits what they can do: MFA on all remote access, least-privilege admin accounts, EDR with 24/7 monitoring, and immutable or air-gapped backups proven by restore drills. The NIST Cybersecurity Framework and the Canadian Centre for Cyber Security's ransomware guidance lay out these controls. Paying carries legal risk, since some groups face sanctions, and does not remove the attacker's foothold or the stolen data. An incident response plan should name who decides and who calls the insurer.
Real-world examples
At home
Marcus, who runs a two-person accounting practice, opened an email that looked like a client invoice. Hours later his files were encrypted with a ransom note. Because his MSP kept nightly offline backups, he restored everything by the next morning instead of paying the $8,000 demand.
At work
Nadia's 30-person law firm was hit overnight. Attackers had disabled the on-site backup server first, but the immutable cloud backup their MSP configured could not be altered. The firm restored operations in two days and reported the data theft to affected clients as required.
Common confusions
- Paying the ransom is the fastest way to recover — Even after paying, decryption tools are often slow, buggy, or incomplete, and some victims never get a working key. Recovering from clean backups is usually faster and doesn't fund the criminals or mark you as a repeat target.
- We're too small for hackers to bother with us — Small businesses are targeted precisely because they tend to have weaker defences. Many attacks are automated and hit whoever is vulnerable, regardless of size.
- Antivirus alone will stop ransomware — Traditional antivirus catches known threats but misses new variants and 'living off the land' techniques. Layered defences (EDR, email filtering, MFA, and tested backups) are what actually reduce the risk.
For analysts
The single biggest factor in ransomware recovery cost is backup quality. A small business should be able to answer three questions: Where are our backups, are they offline/immutable, and when did we last test a full restore?
History & origin
Early ransomware appeared in 1989 (the 'AIDS Trojan' distributed on floppy disks), but the modern era began around 2013 with CryptoLocker, which used strong encryption and Bitcoin payments. Attacks industrialized through the 2010s into 'ransomware-as-a-service', where criminal groups rent out their tools. By the 2020s, attackers added 'double extortion': stealing data before encrypting it and threatening to publish it. Small and mid-sized businesses became prime targets because they hold valuable data but often lack enterprise defences.