If you’ve been hit right now: Disconnect the affected device from the network (unplug Ethernet, turn off WiFi). Do not turn it off — evidence may be in memory. Do not pay yet. Call CISA at 1-888-282-0870 or report to the FBI IC3. If you’re a business, contact your cyber insurance provider immediately.

The TLDR

Ransomware is malware that encrypts your files — documents, photos, databases, everything — and demands payment (usually cryptocurrency) for the decryption key. Modern ransomware operations also steal your data first and threaten to publish it if you don’t pay (“double extortion”). This is a multi-billion dollar criminal industry run by organized groups, not teenagers in hoodies. Individuals lose irreplaceable family photos. Small businesses close permanently. Hospitals have had to divert patients. If this is happening to you: you are not the first, you are not stupid for getting hit, and there are people who can help.

If This Is Happening to You

Before we explain how ransomware works, here’s what matters right now.

For individuals:

For organizations:

The feelings you’re having right now are normal. Panic, shame, anger, helplessness — everyone who gets hit feels these. IT professionals feel like they failed. Business owners feel responsible. Individuals feel violated. These are rational responses. Give yourself permission to feel them, and then focus on the steps above.

What Ransomware Actually Is

At its core, ransomware is encryption used as a weapon. The same math that protects your bank account is used to lock you out of your own files.

When ransomware executes on your system:

  1. It scans for files — documents, spreadsheets, photos, databases, backups it can reach
  2. It encrypts each file with a strong encryption key
  3. It displays a ransom note with payment instructions (usually Bitcoin or Monero)
  4. It may also exfiltrate (steal) your data before encrypting it
  5. A timer starts — the ransom often increases if you don’t pay within 48–72 hours

The encryption is real. Without the key, modern ransomware encryption is mathematically unbreakable. That’s why prevention and backups matter so much — once files are encrypted, your options narrow significantly.

The Variants

Crypto Ransomware

The standard variant. Encrypts your files but leaves the operating system functional so you can read the ransom note and make payment. This is the most common type.

Notable examples: WannaCry (2017, hit hospitals worldwide), REvil (targeted enterprises), LockBit (most prolific group in 2023–2024).

Locker Ransomware

Locks you out of the entire device rather than encrypting individual files. More common on mobile devices. Generally considered less sophisticated and sometimes recoverable without payment.

Wiper Disguised as Ransomware

Destroys data permanently while pretending to be ransomware. The attacker has no intention of providing a decryption key — the goal is destruction, not money. NotPetya (2017) caused $10 billion in global damage while masquerading as ransomware. If a nation-state is behind the attack, assume it’s a wiper.

Double Extortion

The attacker steals your data before encrypting it. If you don’t pay, they threaten to publish it — customer records, employee data, financial documents, intellectual property. Even if you restore from backups, the stolen data is still in their hands. This is now the dominant model. Over 70% of ransomware attacks in 2024 involved data exfiltration.

Triple Extortion

Double extortion plus the attacker contacts your customers, partners, or regulators directly to pressure you. “We have your vendor’s customer database. We’ll release it unless they pay.” The victim’s business relationships become leverage.

Ransomware as a Service (RaaS)

Modern ransomware is a franchise operation. Groups like LockBit, BlackCat/ALPHV, and Cl0p build the ransomware platform, negotiate with victims, and handle payment infrastructure. Affiliates — independent criminals — pay for access or share a percentage of ransoms. This model has industrialized ransomware. The barrier to entry is now technical incompetence. If you can send a phishing email, you can deploy ransomware.

How It Gets In

Ransomware doesn’t magically appear on your system. It arrives through a door someone opened — sometimes you, sometimes a vulnerability in your software.

Phishing emails — The most common entry point. An email with a malicious attachment (Excel macro, PDF exploit, ZIP file) or a link to a credential-harvesting page. One click from one employee on one email.

Exposed Remote Desktop (RDP) — If your Remote Desktop Protocol is exposed to the internet with a weak password, attackers will find it. Automated scanners check every IP address on the internet for open RDP ports continuously. Stolen RDP credentials sell for $5–$50 on dark web markets.

Unpatched vulnerabilities — Software with known security holes that haven’t been updated. The MOVEit vulnerability (2023) allowed the Cl0p group to hit over 2,500 organizations through a single file transfer product.

Supply chain compromise — The attacker compromises a software vendor or managed service provider, then pushes ransomware to all of their customers. The Kaseya attack (2021) hit 1,500 businesses through one IT management platform.

Stolen credentials — Credentials from data breaches, phishing, or infostealers get used to log into VPNs, email, or cloud services. From there, the attacker moves laterally through the network until they have enough access to deploy ransomware everywhere at once.

The Decision: To Pay or Not

This is the hardest question, and there’s no universally right answer.

Arguments against paying:

The reality:

If you’re considering payment:

The Human Cost

Ransomware isn’t just a technical problem. It affects real people.

IT teams: The admin who gets the call at 2 AM and walks into a screen full of ransom notes carries that with them. The self-blame — “I should have patched that server,” “I should have caught that email” — is real and persistent. Burnout and PTSD-like symptoms are common among incident responders.

Business owners: Small businesses that don’t have cyber insurance or robust backups face an existential threat. The National Cyber Security Alliance estimates that 60% of small businesses that suffer a significant cyber attack close within six months.

Healthcare workers: When ransomware hits a hospital, surgeries get postponed, ambulances get diverted, and patient records become inaccessible. In 2020, a patient in Germany died after being redirected from a ransomed hospital to one farther away. Real people are harmed.

Individuals: The family photos from your grandmother’s 90th birthday. The novel you’ve been writing for three years. The tax documents you need for next month. Ransomware doesn’t distinguish between critical infrastructure and personal memories.

If you’re an IT professional who’s been through this: It wasn’t your fault. Ransomware is a criminal act committed by professional criminals with significant resources. One missed patch or one clicked link doesn’t make you responsible — it makes you human. Talk to someone. Your peers have been through it too.

Prevention

You can’t eliminate the risk, but you can make ransomware survivable.

Backups — the single most important defense:

Patching:

Email security:

Access control:

Endpoint protection:

Resources