Ransomware
Also known as: ransom malware, crypto-ransomware, file-encrypting malware, double extortion
Ransomware is malicious software that locks up your files by encrypting them, then demands a ransom (usually in cryptocurrency) to restore access.
For a small business, an attack can halt operations for days, and paying the ransom offers no guarantee your data comes back.
Ransomware, explained at three levels
At home
Imagine turning on your computer and every document, photo, and spreadsheet is locked, with a message demanding money to get them back. That's ransomware. It usually sneaks in when someone opens a bad email attachment or clicks a malicious link.
At work
For a business, ransomware can freeze every computer at once -- no invoices, no customer records, no email. Recovery can take days or weeks. The best protection is prevention (training staff, filtering email) plus reliable backups so you can restore without paying.
At home
Ransomware typically encrypts files with a key only the attacker holds. Even security experts usually can't decrypt them without that key. This is why backups matter so much: a clean, offline backup lets you wipe the infected machine and restore your files instead of negotiating.
At work
Modern attacks often start weeks before the encryption event -- attackers gain a foothold, move across the network, disable backups, and steal data, then trigger encryption everywhere at once. Defenses include endpoint detection (EDR), network segmentation, immutable backups, and multi-factor authentication to block the initial login.
At home
Ransomware families use hybrid encryption: a fast symmetric cipher (AES) encrypts files, and the AES key is itself encrypted with the attacker's public RSA key. Only the attacker's private key can unlock it. Some strains also target Volume Shadow Copies and connected backup drives to remove your recovery options.
At work
Mature defense assumes breach: least-privilege access, immutable/air-gapped backups tested by regular restore drills, EDR/MDR with 24/7 monitoring, and an incident response plan naming who does what. Cyber insurance often requires MFA, EDR, and offline backups as conditions of coverage. Paying a ransom may also breach sanctions rules if the group is on a government blocklist.
Real-world examples
At home
Marcus, who runs a two-person accounting practice, opened an email that looked like a client invoice. Hours later his files were encrypted with a ransom note. Because his MSP kept nightly offline backups, he restored everything by the next morning instead of paying the $8,000 demand.
At work
Nadia's 30-person law firm was hit overnight. Attackers had disabled the on-site backup server first, but the immutable cloud backup their MSP configured could not be altered. The firm restored operations in two days and reported the data theft to affected clients as required.
Common confusions
- Paying the ransom is the fastest way to recover — Even after paying, decryption tools are often slow, buggy, or incomplete, and some victims never get a working key. Recovering from clean backups is usually faster and doesn't fund the criminals or mark you as a repeat target.
- We're too small for hackers to bother with us — Small businesses are targeted precisely because they tend to have weaker defenses. Many attacks are automated and hit whoever is vulnerable, regardless of size.
- Antivirus alone will stop ransomware — Traditional antivirus catches known threats but misses new variants and 'living off the land' techniques. Layered defenses -- EDR, email filtering, MFA, and tested backups -- are what actually reduce the risk.
For analysts
The single biggest factor in ransomware recovery cost is backup quality. A small business should be able to answer three questions: Where are our backups, are they offline/immutable, and when did we last test a full restore?
History & origin
Early ransomware appeared in 1989 (the 'AIDS Trojan' distributed on floppy disks), but the modern era began around 2013 with CryptoLocker, which used strong encryption and Bitcoin payments. Attacks industrialized through the 2010s into 'ransomware-as-a-service', where criminal groups rent out their tools. By the 2020s, attackers added 'double extortion' -- stealing data before encrypting it and threatening to publish it. Small and mid-sized businesses became prime targets because they hold valuable data but often lack enterprise defenses.