Ransomware

What it is

It can hit a home PC or an entire business network. Attackers may also steal a copy of your data and threaten to publish it (double extortion). Payments are often demanded in cryptocurrency and never guarantee recovery.

For individuals, ransomware frequently arrives through phishing attachments, cracked software, or remote-desktop exposure.

How it works

1. Delivery — Phishing, malicious downloads, infected USB, or exploited remote access.
2. Execution — Malware runs and may disable backups or security tools.
3. Encryption / lock — Files become unreadable; a ransom note appears.
4. Extortion — Pay demand, sometimes with a countdown and leak threats.
5. Aftermath — Even after payment, data may remain stolen or partially corrupted.
6. Business email compromise and ransomware crews sometimes overlap in targeting.

Red flags

• Files suddenly will not open; extensions look strange
• A ransom note image, text file, or wallpaper appears
• Security software or backups were mysteriously turned off
• Unusual network or disk activity before the lock
• Extortion emails claiming your data will be leaked
• Coworkers reporting the same issue at the same time (business)

What to do if you’re targeted

• **Disconnect** the device from Wi-Fi/Ethernet to limit spread; do not pay hastily — payment is risky and may fund crime.
• **Photograph the ransom note** and note any IDs; then seek help — for businesses, engage incident-response professionals.
• **Restore from offline backups** if you have clean copies; scan systems before reconnecting.
• **Report** to local law enforcement and IC3.gov (U.S.); CISA resources can help organizations.
• **Rotate passwords** from a clean device, especially if credentials may have been stolen.
• **Personal data angle:** if files included ID scans or tax docs, monitor for identity theft and consider a free identity scan.

Related terms

• Phishing
• Data breach
• Business email compromise