Ransomware Explained

What ransomware is

CISA's definition is the plain one: malware that encrypts the files on a device so the files, and anything that depends on them, stop working, followed by a demand for payment in exchange for the key. Since about 2020 most crews also copy your data out first and threaten to publish it if you do not pay. CISA calls that pairing "double extortion." Some groups now skip the encryption and just steal and threaten. The lock screen is the visible part; the copied data is the part that keeps costing you after the screen is gone.

How an attack unfolds

1. Entry. A phishing email, a password reused from an old breach, an unpatched VPN or firewall, or a remote desktop port left open to the internet. One foothold is enough.
2. Spread. Hours to weeks of quiet movement through the network, and a deliberate hunt for backups. CISA's guide notes that many ransomware variants "attempt to find and subsequently delete or encrypt accessible backups" so restoration is impossible without paying. That single sentence is why the offline copy matters.
3. Theft. Data is copied out before anything is encrypted, for leverage.
4. Detonation. Simultaneous encryption across every reachable machine, usually at night or on a holiday weekend.
5. The demand. A note with a countdown, a chat portal, and, at the larger crews, a helpdesk with better response times than most software companies.

The 2026 numbers

Two data sets, published in 2026, describe the current picture. The FBI's Internet Crime Complaint Center counts what was reported to it in 2025. Sophos surveyed 2,158 IT and security leaders in 17 countries, at organizations of 100 to 5,000 employees, between January and March 2026.

How it gets in, ranked

For the first time in four years, exploited software bugs are not the top cause. People are. Sophos found that 79 percent of attacks began with an identity: a stolen password, a phished login, an abused account. Match your defenses to this list, not to the movie version.

Should you pay?

Plan not to, and make that plan before you need it. Three reasons. First, paying funds the next hundred attacks and marks you as someone who pays. Second, a payment buys a promise from a criminal: the decryptor may be slow, partial, or broken, and nothing stops them keeping the data they copied. Third, the number that actually predicts recovery is not the ransom, it is whether you have a backup the attackers could not reach. In the 2026 survey, two in three victims restored from backups, and the share paying has fallen every year since 2024 as backups improved. For a home user or a small business with a tested offline backup, there is nothing to buy.

CISA and the FBI want three things from a victim: isolate the infected machines, report the attack, and restore from clean backups. Their response checklist starts with disconnecting, not negotiating. Report to your local FBI field office or IC3; law enforcement sometimes has a free decryptor for older variants and will tell you.

Defenses that actually work, ranked

The 90-minute defense plan

1. Buy or find an external drive and back up tonight (30 min). Time Machine on a Mac, File History or the Windows Backup app on a PC. Unplug the drive when it finishes.
2. Turn on cloud backup with version history for your key folders (15 min). Photos and documents at minimum.
3. Turn on automatic updates (10 min). Computer, phone, browser, router.
4. Add passkeys or app-based MFA to email, bank, and your Apple or Google account (25 min).
5. Restore one file from the drive and one from the cloud (10 min). An untested backup is a rumor.

If it happens: the first hour

This follows CISA's response order. Do not start by looking for a decryptor and do not reboot to "see if it clears."

1. Disconnect. Pull the network cable, turn off Wi-Fi, unplug any external drive that is still attached. If you cannot disconnect a device, power it off. Do this on every machine in the house or office, not just the one showing the note.
2. Photograph the ransom note with your phone. Investigators and free decryptor databases identify the crew from it.
3. Do not pay and do not reply yet. The countdown is a sales tactic.
4. Report. IC3 for anyone in the U.S.; your bank if any financial account may be involved; your employer's IT team if a work device is affected.
5. Change passwords from a clean device, starting with email, and revoke sessions on the accounts the infected machine was logged into.
6. Wipe and restore. Reinstall the operating system, then restore files from the offline or versioned copy. Restore documents first, then photos, then everything else. Scan the restored files before reconnecting the drive to anything.
7. Watch for the second act. Stolen data feeds identity theft for years. Freeze your credit and follow the breach checklist.