Ransomware

Ransomware is a type of malware that blocks a victim’s access to their own files or entire computer system, typically by encrypting the data so it becomes unreadable without a special decryption key, and then demands a ransom payment, usually in cryptocurrency, in exchange for restoring access. Ransomware has grown from a relatively rare nuisance into one of the most financially damaging categories of cybercrime in the world, capable of shutting down hospitals, schools, factories, and city governments for days or weeks at a time, and the payments involved have at times reached into the tens of millions of dollars for a single incident affecting a large organization.

How a Ransomware Attack Unfolds

Most ransomware attacks begin with an initial point of access, commonly a phishing email, a vulnerability in software exposed to the internet, or stolen remote-access credentials purchased from other criminals. Once inside a network, attackers often spend time moving quietly between systems, identifying valuable data and critical infrastructure, and disabling backup systems specifically so the victim has fewer options besides paying the ransom, before finally triggering the encryption process across as many systems as possible at once to maximize disruption and pressure. Many modern ransomware operations also steal a copy of sensitive data before encrypting it, then threaten to publish that stolen data publicly if the ransom is not paid, a tactic known as double extortion that adds reputational and legal pressure on top of the simple loss of access to files.

After the attack, victims typically see a ransom note explaining what happened, demanding a specific payment amount, often in Bitcoin or another cryptocurrency chosen partly for the relative difficulty of tracing it, and providing instructions for how to pay in exchange for a decryption key. Even after payment, there is no guarantee that a decryption key will actually be provided or that it will fully restore every affected file, and law enforcement agencies in many countries generally discourage paying ransoms, both because it funds further criminal activity and because it does not guarantee a successful recovery.

Ransomware-as-a-Service and Prevention

Much of the modern ransomware threat is organized around a business model called ransomware-as-a-service, in which skilled developers build and maintain the ransomware tools themselves, then lease or license that tool to other criminals, called affiliates, who carry out the actual attacks against victims in exchange for a share of any resulting ransom payment. This arrangement has dramatically lowered the technical skill required to launch a ransomware attack, since an affiliate does not need to understand how the underlying encryption or malware code actually works, only how to gain initial access to a target’s network.

Defending against ransomware relies heavily on maintaining regular, isolated backups that are not directly accessible from the main network, so data can be restored without paying a ransom even if the primary systems are affected. Additional defenses include promptly applying security updates to close known vulnerabilities, using multi-factor authentication to make stolen credentials less useful to an attacker, segmenting networks so that a ransomware infection in one area cannot easily spread to every other system, and training employees to recognize phishing attempts, since human error in opening a malicious attachment or link remains one of the most common ways ransomware initially gains entry to a network.

From a Single Floppy Disk to Global Crisis

One of the earliest documented examples of ransomware appeared in 1989, spread on floppy disks mailed to attendees of a health research conference, demanding payment be sent through the postal mail, a slow and limited method of extortion by modern standards. Ransomware remained a relatively minor threat for years afterward, held back largely by the lack of a reliable, hard-to-trace way for victims to pay attackers at scale, until the rise of cryptocurrency in the 2010s removed that obstacle and made large-scale extortion payments far more practical for criminals operating anywhere in the world.

Since then, a series of major ransomware campaigns have disrupted hospitals, pipelines, shipping companies, and government agencies around the world, drawing sustained attention from law enforcement agencies and national governments that increasingly treat large-scale ransomware attacks as a serious national security concern rather than simple criminal activity. International law enforcement operations have periodically succeeded in disrupting or dismantling major ransomware groups and recovering some stolen funds, though the ransomware-as-a-service business model has made the overall threat resilient, with new groups and tools regularly emerging to replace ones that are taken down.

Frequently Asked Questions

Should a ransomware victim pay the demanded ransom? Law enforcement agencies in most countries generally advise against paying, since it funds further criminal activity and offers no guarantee that files will actually be restored, though some organizations facing severe operational or safety consequences have chosen to pay despite these risks, making it a difficult decision usually made in consultation with security experts and law enforcement.

What is double extortion in a ransomware attack? Double extortion refers to attackers stealing a copy of sensitive data before encrypting a victim’s systems, then threatening to publish that stolen data publicly in addition to withholding the decryption key, adding reputational, legal, and regulatory pressure beyond the simple loss of access to files.

What is the single most effective defense against ransomware? Security experts generally point to maintaining regular, isolated backups as one of the most effective defenses, since they allow an organization to restore its systems without paying a ransom, combined with prompt software updates, multi-factor authentication, and employee training to reduce the chances of an initial infection in the first place.

Editorially reviewed by Specialty Digest Editorial TeamLast reviewed November 2, 2026Researched and drafted with AI assistanceReport an issue