Ransomware Explainer
Ransomware is malicious software used to block access to data or systems, usually by encrypting files. Attackers often demand payment in exchange for a decryption tool or for a promise not to release information they stole.
It can reach an organization through a phishing message, an unpatched system, weak remote-access credentials, or software already on a compromised device. Once inside, an attacker may try to spread across connected systems and look for valuable data or backups.
A payment demand does not guarantee recovery. A prepared response focuses on isolating affected devices, preserving evidence, notifying the right people, and restoring clean systems and data when possible.
Strong backups, prompt security updates, multi-factor authentication, and careful access controls reduce the risk. Offline or otherwise protected backups are especially important because ransomware often tries to damage copies it can reach.
Ransomware is malware that encrypts, locks, or threatens to expose data in order to pressure a victim to pay. It can affect one device or a wider network.
Initial access can come from phishing, stolen passwords, exposed remote services, or unpatched software. Attackers may then move to other connected systems if access controls allow it.
Backups disconnected or strongly protected from the main network are harder for an attacker to erase or encrypt. They provide a safer path to recovery after an incident.
Explore more "Explainers"
Discover additional explainers across politics, science, business, technology, and other fields. Each explainer breaks down a complex idea into clear, everyday language—helping you better understand how major concepts, systems, and debates shape the world around us.