Cybersecurity

What Is Ransomware? A Plain Guide

Ransomware is a type of malware that locks your files or your whole device and demands payment — usually in cryptocurrency — for their return. It has shut down hospitals, schools, councils and small businesses, and it now targets individuals too. This guide explains how ransomware works, how it spreads, and the defences that actually stop it.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What ransomware is

Ransomware is malicious software that encrypts — scrambles — your files so you cannot open them, then demands a payment for the key that would unscramble them. The ransom note usually appears on screen, with a deadline, a payment address, and a threat: pay, or the files are deleted or published. The payment is almost always demanded in cryptocurrency, which is harder to trace than a bank transfer.

Modern ransomware is rarely a lone attacker's project. It is run by organised criminal groups, often as a business: developers build the software, affiliates spread it, and profits are shared. Some groups operate leak sites where they publish stolen data from victims who refuse to pay — a tactic called double extortion, explained in its own guide in this section.

Ransomware matters to everyone, not just large organisations. Small businesses, schools, charities and hospitals are frequent targets precisely because they have valuable data and limited security budgets. Individuals are targeted too, often through phishing emails or fake downloads, and a home computer full of family photos is as much a hostage as a company database.

How a ransomware attack unfolds

Most ransomware attacks begin with access, not with encryption. The attacker gets in through a phishing email with a malicious attachment, a stolen password bought or harvested from an earlier breach, an unpatched remote-access service, or a compromised software update. Once inside, they explore quietly — often for days or weeks — finding the valuable data, the backups, and the way out.

Then comes the theft. Many groups now copy data out of the network before they encrypt anything, so that they can threaten to publish it as well as withholding it. Only then does the encryption begin, usually outside working hours, to maximise disruption before anyone notices. By the morning, files are locked, systems are down, and the ransom note is on every screen.

The ransom demand follows, with a deadline and usually a chat or support channel — criminals have learned that a victim who can negotiate is a victim who might pay. The amount is often set according to what the attackers believe the victim can afford, based on the data they stole during their quiet exploration.

Who ransomware targets, and why

Ransomware groups target whoever looks profitable and poorly defended. Small businesses are attractive because they hold customer and financial data but rarely have a dedicated security team. Healthcare is targeted because downtime has immediate, visible consequences. Schools and councils are targeted because they must keep services running and because their data — children's records, residents' details — is sensitive.

Individuals are targeted opportunistically, through phishing and fake downloads, and through ransomware that spreads automatically between connected devices. A home network with no backups and one shared computer is an easy target: the ransom may be smaller, but the pain — lost photos, lost documents — is real.

No organisation is too small to be targeted, and no organisation is too large to be safe. The pattern is consistent: the attackers look for weak passwords, unpatched systems, missing backups and staff who have not been trained to spot phishing. Every one of those is fixable.

The damage a ransomware attack causes

The immediate damage is lost access: files you cannot open, systems that will not start, services that stop working. For a business that can mean days or weeks of downtime, lost orders, and staff who cannot work. For a hospital or a school it can mean cancelled appointments or closed classrooms. For an individual it can mean years of photos and documents gone.

The longer damage is often worse. Stolen data may be published or sold, leading to identity theft, fraud, and regulatory consequences. Customers lose trust, and in some jurisdictions the organisation must report the breach and may face fines. Recovery costs — rebuilding systems, restoring from backups, hiring specialists — often dwarf the ransom itself, whether or not it is paid.

There is a human cost too. Staff who clicked the phishing email often feel responsible, and the pressure on small teams during a long recovery is intense. That is why preparation, including practising the response, matters as much as any technical defence.

How to protect yourself and your organisation

Backups are the single most effective defence. Keep regular backups of important data, keep at least one copy offline or in a way ransomware cannot reach — a disconnected drive or an immutable backup — and test that you can actually restore from them. A backup you have never tested is a hope, not a plan. With a good backup, ransomware becomes an inconvenience instead of a catastrophe.

Next, close the common entry points. Turn on multi-factor authentication on every account, especially email and remote access. Keep systems and software patched, and pay particular attention to remote-access services and internet-facing systems. Train staff to recognise phishing, and make reporting easy — the person who reports a suspicious email early may stop the whole attack.

Segment your network where you can, so that one infected machine cannot reach everything. Limit who has administrator access, and use strong, unique passwords managed by a password manager. Finally, have a written incident plan, and practise it: who do you call, who decides, and what do you do first? The middle of an attack is the worst time to write one.

• Back up regularly, keep one copy offline, and test restores.
• Multi-factor authentication on email and remote access.
• Patch systems promptly, especially internet-facing ones.
• Train staff on phishing and make reporting blame-free.
• Have a written incident plan — and practise it.

If you are hit by ransomware

Disconnect the affected devices from the network immediately, but do not turn them off — evidence and memory contents can help investigators. Do not pay. Report the attack to law enforcement: in the US, the FBI Internet Crime Complaint Center at ic3.gov; in the UK, Action Fraud and the National Cyber Security Centre. Preserve the ransom note and any messages from the attackers, and do not delete logs.

Check the free decryption site No More Ransom (nomoreransom.org), a joint project of law enforcement and security companies, which provides free decryption tools for many ransomware variants — it is worth checking before you assume the files are lost. Then restore from your backups onto clean systems, and change passwords from a clean device.

Tell the people affected: customers, staff, or anyone whose data may have been stolen. Be honest about what happened and what you are doing. For organisations, legal advice and a check on breach notification duties are essential, because the law may require you to notify regulators and the people affected within a set time. Our guide on whether to pay ransomware covers the official line and the recovery steps in full.

Sources

• CISA — Ransomware guidance — last checked 14 November 2026.
• National Cyber Security Centre (UK) — Ransomware guidance — last checked 14 November 2026.
• No More Ransom — Free decryption tools — last checked 14 November 2026.
• FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.

Last checked: 14 November 2026.

Frequently asked questions

What is ransomware in simple terms?

Ransomware is malicious software that locks your files by encrypting them, then demands payment for the key to unlock them. Modern attacks also steal data first, so attackers can threaten to publish it as well as withholding it.

Can ransomware spread to other computers?

Yes. Once inside a network, ransomware can move between connected devices and shared drives. That is why the first response is to disconnect affected machines from the network, and why separating networks and keeping backups offline matters.

Should I pay the ransom?

Law enforcement and security agencies in the US and UK advise against paying. Payment does not guarantee your files back, marks you as someone who pays, funds further crime, and in some cases may breach sanctions law. Free decryption tools and backups are the better path.

Can ransomware be removed?

Security software can often remove the ransomware program itself, but removal does not decrypt your files. Files are recovered from backups or, for some variants, with free decryption tools from No More Ransom. Without either, the data may be unrecoverable.

Does antivirus stop ransomware?

It helps, but it is not enough on its own. Ransomware often enters through phishing or stolen passwords, which antivirus cannot stop. Backups, multi-factor authentication, patching and phishing awareness are the layers that matter most.