MY ONE BLOGby Manishdai
Cybersecurity

What is Ransomware?

Quick answer

Malware that encrypts or steals a victim's files and demands payment, usually in cryptocurrency, to restore access or prevent leaks.

Ransomware, explained

A ransomware attack typically begins with phishing, stolen credentials, or an unpatched vulnerability. Once inside, attackers often move through the network, disable backups, steal sensitive data, and then encrypt files across many systems at once. A ransom note explains how to pay.

Many groups now use double extortion, threatening to publish stolen data even if the victim can restore from backups. Ransomware has disrupted hospitals, schools, local governments, and businesses of all sizes, and some criminal groups rent their tools to affiliates in a model called ransomware as a service. Authorities generally discourage paying, since payment does not guarantee recovery. Key defenses include tested offline backups, patching, multi-factor authentication, network segmentation, and a rehearsed incident response plan.

Related terms

Cloud Backup

Copying data from computers, servers, or applications to storage run by a cloud provider so it can be restored if the original is lost.

Cyber Insurance

An insurance policy that helps cover financial losses from cyber incidents such as data breaches, ransomware, and online fraud.

Disaster Recovery

The plans, tools, and processes an organization uses to restore its IT systems and data after a major outage, attack, or disaster.

Incident Response

An organization's structured process for detecting, containing, investigating, and recovering from security incidents.

Malware

Malicious software designed to damage, disrupt, spy on, or gain unauthorized access to computers and networks.

Phishing

A social engineering attack that uses fake emails, messages, or websites to trick people into revealing information or installing malware.

Guides that mention Ransomware