What is ransomware? Definition, types, and protection tips

What is ransomware? 

Ransomware is a type of malware that prevents users or organizations from accessing files on their computer or network. Hackers use ransomware to lock or encrypt data on infected devices, demanding payment in exchange for the decryption key. While the primary motivation behind most ransomware attacks is financial gain, some attackers aim to disrupt business operations, causing costly downtime and reputational harm.

Short history of ransomware

Ransomware started as a simple trick hidden on a floppy disk. As the years passed, its primary mission remained the same — to extort money from unsuspecting users. Here’s how the ransomware tactics changed as technology developed: 

• Late 1980s. It all started in 1989 with the “AIDS Trojan” (or “PC Cyborg”). Handed out on physical floppy disks at a health conference, this crude program hid users’ files and demanded a mailed payment — a blueprint for modern cyber extortion.
• Early 2000s. Attackers upgraded their strategy by using encryption like RSA and AES, giving rise to “crypto ransomware.” Early antivirus tools struggled to keep up, while untraceable wire transfers made it easy for hackers to walk away with the cash.
• 2010s. Ransomware attacks exploded in scale and speed. The infamous 2017 WannaCry outbreak used leaked government exploits to spread automatically across networks, crippling hospitals and corporations in hours. This era also birthed “Ransomware-as-a-Service” (RaaS), allowing non-technical criminals to rent malware and launch attacks.
• 2020s. Today, hackers don’t just lock files — they steal sensitive data first and threaten to leak it online. This double extortion tactic means backups alone are no longer enough to save a business. On top of that, state-sponsored groups now use ransomware for political espionage and sabotage, which blurs the line between financial crime and cyber warfare.

How does a ransomware attack work? 

A ransomware attack typically unfolds through five stages, taking the target from initial exposure to final extortion:

1. 1. Infection. Cybercriminals gain entry using social engineering techniques, such as infecting devices through mass phishing attacks, targeted spear phishing emails, or unpatched vulnerabilities. Famous ransomware examples show that attackers may also disguise ransomware as a software update to trick people into installing it. 
2. 2. Expansion. Once inside, the malware moves through the network to identify connected devices, core servers, and backup files to maximize its reach.
3. 3. Encryption. Attackers typically rely on hybrid encryption to lock files. They use a public key to encrypt the data and a private key (stored on the hacker’s server) to decrypt it. 
4. 4. Extortion. The malware displays a message on the victim’s screen, like threatening to publicly leak sensitive data or permanently destroy files if demands aren’t met.
5. 5. Resolution or ransom payment. The victim must decide whether to restore systems from isolated backups or proceed with a ransom payment, hoping to recover their files. However, there is no guarantee that the criminals will actually restore access.

How does ransomware spread?

Ransomware rarely infects a system by accident — it usually sneaks in by exploiting human trust or taking advantage of an overlooked security gap. Here are the most common ways ransomware spreads:

• Phishing and spear phishing emails. Attackers send deceptive emails with infected attachments or links that trigger a malware download when clicked. Setting up advanced email filters and training team members to spot suspicious messages stops most of these traps.
• Malicious downloads and malvertising. Hackers hijack online ads or compromise legitimate websites to push malware onto devices. You can neutralize this threat by using ad blockers, enforcing web filtering, and insisting on official software sources.
• Exposed or weak RDP. Unprotected Remote Desktop Protocol (RDP) connections give attackers a direct doorway to brute-force passwords and manually install ransomware. To shut entry points, require multi-factor authentication (MFA), place remote access behind a VPN, and close unused ports.
• Unpatched software vulnerabilities. Cybercriminals run automated scans to find outdated operating systems or apps with known security flaws. Enabling automatic updates and staying on top of routine software patching seals off these entry points before hackers can exploit them.
• Stolen or reused credentials. Hackers buy leaked usernames and passwords on the dark web to log in to business networks unnoticed. Enforcing strong password policies and mandating MFA across all accounts ensures a stolen password alone isn’t enough to grant attackers access to your system.
• Malicious USB drives. Attackers leave infected flash drives in public places like parking lots or lobbies, relying on curiosity to get someone to plug the device into a computer. Disabling USB auto-run features and blocking unauthorized removable media keep these physical traps from working.
• Social engineering. Criminals pretend to be IT personnel, executives, or trusted suppliers to trick employees into handing over passwords or installing fake software updates. Establishing a clear policy for verifying unusual IT requests protects your team from falling for convincing scams.

Notable ransomware examples 

There are numerous ransomware families, each with its own set of ransomware variants. These have done the most damage in recent years:

1. 1. REvil (or Sodinokibi). A pioneer of the “Ransomware-as-a-Service” (RaaS) and double-extortion model. Though disrupted by law enforcement, its source code and tactics laid the structural blueprint for modern enterprise extortion groups. REvil is responsible for several high-profile attacks, including the one on Kaseya in 2021 opens in a new tab. 
2. 2. Dharma (or CrySiS). This ransomware targets Windows systems and has multiple variants. CrySiS usually infiltrates systems through exposed Remote Desktop Protocol (RDP) ports. Cybercriminals still deploy Dharma variants today, mainly targeting exposed RDP ports at small and medium-sized businesses.
3. 3. DarkSide. Another RaaS operation, DarkSide spreads with hackers exploiting weaknesses in RDP. This group claimed responsibility for the high-profile attack on Colonial Pipeline in May 2021, which resulted in significant fuel shortages in parts of the US. 
4. 4. GoodWill ransomware. First identified in 2022, GoodWill stands out for its goal — instead of money, the group demands that victims perform acts of kindness for people in need.
5. 5. LockBit (LockBit 2.0 and 3.0). One of the most prolific enterprise RaaS strains to date. Now in its 3.0 version, LockBit combines automated high-speed encryption with double extortion and keeps resurfacing despite law enforcement takedowns. It primarily targets large organizations and government entities, exploiting vulnerabilities in their network security systems. 
6. 6. Cl0p (Clop). A dominant threat strain that shifted the ransomware landscape by targeting zero-day vulnerabilities in widely used enterprise software (such as MOVEit Transfer and GoAnywhere MFT) to steal data from thousands of targets simultaneously.
7. 7. Akira. Emerged in 2023 and rapidly grew into a top RaaS operation targeting both Windows and Linux/VMware ESXi environments, frequently gaining initial access through vulnerable VPN endpoints.
8. 8. RansomHub. A modern RaaS operation that quickly rose to prominence and deployed aggressive data leak operations across global corporate networks. RansomHub primarily targeted critical infrastructure sectors, financial services, and commercial enterprises across more than 75 countries, focusing heavily on organizations in the US and Europe. 

What are the symptoms of ransomware?

There are six main signs of ransomware infection that should immediately draw your attention and encourage you to take action:

• Inexplicable slowdown of computers and network activities. This is one of the earliest signs of a ransomware attack. Ransomware starts by scanning devices for file storage locations, which drags performance down. You might think the device has slowed down because too many users are depleting the bandwidth, but take a closer look to determine the real reason.
• Suspicious changes to files, their names, and their locations. If files or folders change, unknown or unaccounted-for files appear, or files lose their extensions, you may be looking at a cyberattack.
• Unauthorized extraction of data. If files go missing, treat it as a sign of a potential breach and inspect it.
• Unrecognized and unwanted file encryption. Act immediately if you notice encrypted files on your network that no one has knowledge of or accountability for.
• A locked desktop. Some ransomware variants lock your entire desktop, preventing you from using your computer until you pay a ransom.
• An on-screen ransom message. The most obvious indicator of a ransomware attack is the message on your computer screen informing you about the ransomware infection.

What are the types of ransomware? 

Criminals pick their ransomware based on how they plan to extort the victim.

Ransomware commonly falls into these types, and here’s how they differ in more detail. 

Crypto ransomware

Crypto ransomware is the most common type of ransomware you’ll encounter. Once it slips into your system, it locks down your personal files (like documents or photos), rendering them unreadable. To restore access, attackers demand a ransom payment in exchange for the decryption key.

Because modern variants use high-grade encryption, recovering your data without that key or an isolated backup is nearly impossible. Infamous examples like CryptoLocker and CryptoWall helped pioneer this tactic, showing cybercriminals just how effective locking people out of their own files can be.

Locker ransomware 

Locker ransomware freezes your entire device or screen, blocking access to your system. Rather than encrypting individual files, it locks down the user interface and displays a persistent full-screen message demanding payment.

Behind the locked screen, your files usually remain completely intact. Attackers rely on the immediate panic of being locked out to pressure victims into paying before they realize their files were never encrypted. While this threat can affect desktop computers, locker ransomware is far more common on mobile devices, where rogue apps easily exploit screen display permissions to lock you out.

Scareware 

Scareware uses fear and intimidation to trick victims into paying money. It floods your screen with alarming pop-up messages claiming your device is heavily infected with viruses or that law enforcement has flagged your system for illegal activity. These fake alerts demand immediate payment to clean the computer or avoid legal action.

In reality, scareware rarely involves any real file encryption — your data usually remains untouched. The threat is entirely manufactured, relying on sheer panic and urgency to convince you to hand over payment or financial details before you realize it’s a scam.

Doxware (leakware)

Doxware (also known as leakware) takes extortion a step further by stealing your sensitive data before locking anything down. Cybercriminals then threaten to publish private documents, customer records, or proprietary secrets online unless you pay a ransom.

This tactic is the primary mechanic behind “double extortion.” By adding the threat of a public leak, doxware completely negates the classic “just restore from backup” defense. Even if you can cleanly restore all your files from a backup, the threat of exposed privacy, regulatory fines, and reputational damage still puts immense pressure on victims to pay.

Ransomware-as-a-Service (RaaS) 

Ransomware-as-a-Service (RaaS) operates like a dark-web franchise model. Core malware developers build and maintain the ransomware software, while third-party “affiliates” rent or purchase the tools to carry out the actual breaches. When a victim pays, the ransom is split, with affiliates taking a major cut.

This business model drastically lowers the technical bar for cybercriminals. Attackers don’t need advanced coding skills — they can simply rent a turnkey malware package and hit large organizations. By making sophisticated cybercrime accessible to practically anyone, RaaS has fueled a surge in global attack volume.

Who are the main victims of ransomware attacks?

Ransomware victims range from individuals to organizations and businesses. According to Statista’s global data on ransomware attacks opens in a new tab, cybercriminals mostly target institutions and organizations that are mission critical, such as healthcare, finance, manufacturing, and government organizations. These entities typically have more valuable data, greater financial resources, and a higher likelihood of paying a significant ransom.

Businesses 

Ransomware attackers target companies of all sizes, knowing these organizations hold valuable data, customer information, and intellectual property they’ll pay to get back.

According to Verizon’s 2026 Data Breach Investigations Report, ransomware was present in 48% of all confirmed data breaches opens in a new tab. When you look past the numbers, you see real companies and public institutions facing massive disruptions and huge ransom demands. In 2025, K-12 software provider PowerSchool suffered a data breach opens in a new tab exposing sensitive information of over 62 million individuals, with attackers demanding a $2.85 million Bitcoin ransom. 

OUR EXPERT SAYS

Ransomware attackers don’t care about company size. Large corporations and small businesses alike can become targets, with attackers often focusing on whichever organization appears easiest to exploit.

Aivaras Vancevičius, head of product at NordLocker

Healthcare organizations and critical infrastructure 

In the eyes of cybercriminals, healthcare organizations are lucrative targets that store highly sensitive and life-critical patient information. According to the 2025 Internet Crime Report by the US Federal Bureau of Investigation, healthcare was the most targeted critical industry by ransomware in 2025 in the US opens in a new tab.

Attacks on critical infrastructure, such as power grids and transportation systems, cause widespread disruption. This was made clear during the 2021 Colonial Pipeline attack opens in a new tab, where a single ransomware incident halted major US fuel supplies and sparked regional shortages.

Individuals and home users 

Cybercriminals target individuals too, because people also hold data they can’t afford to lose, like financial information, family photos, or personal documents. Cybersecurity statistics on ransomware attacks on individuals are less reliable, because victims rarely report them to law enforcement.

On personal devices like Android smartphones, these attacks often use screen lockers or file-encrypting malware that can corrupt both local files and automatically synced cloud backups. Victims often pay small ransoms out of pocket to recover irreplaceable photos and documents.

What is the impact of a ransomware attack? 

A ransomware attack’s impact causes companies severe financial, reputational, and legal damage. Even if the targeted organization refuses to pay, expenses incurred from downtime and lost trust can be significant.

Financial costs 

Ransomware victims might suffer a severe financial impact if they decide to fulfill ransom demands. Sophos’s State of Ransomware 2026 report opens in a new tab highlights that the median ransom demand reached $769,000. Even if the company does not pay a ransom, a ransomware infection usually causes costly downtime. Sophos states 83% of organizations recovered within a month.

Beyond downtime, the recovery process might also be lengthy and expensive. The company must investigate the breach, improve its cybersecurity defenses, and restore its systems and data. IBM’s Cost of a Data Breach Report 2026 opens in a new tab notes that the average cost of an attack involving a data breach across all industries reached $4.99 million, while Sophos estimates that the average global cost of ransomware recovery, excluding any ransom payments, stands at $1.7 million.  

Reputational damage

Reputational damage is another critical consequence of ransomware attacks because these attacks erode public trust. Customers who lose confidence take their business elsewhere, and the brand damage outlasts the incident.

For example, in 2025, ransomware attackers compromised Marks & Spencer customer information and paralyzed its e-commerce operations for weeks opens in a new tab, triggering public backlash and lasting reputational harm. Even if hackers do not steal any sensitive data, the public disclosure of a ransomware attack can raise concerns among customers and partners about the organization’s cybersecurity resilience.

Legal and regulatory consequences

Ransomware infections may cause severe legal and regulatory consequences, such as fines and penalties for failing to protect sensitive data. Organizations must comply with data protection laws, such as the General Data Protection Regulation (GDPR) in Europe or the California Consumer Privacy Act (CCPA) opens in a new tab in the United States. Beyond privacy compliance, paying a ransom introduces additional legal exposure under sanctions enforced by the U.S. Office of Foreign Assets Control (OFAC), which strictly prohibits financial transactions with designated threat actors.

Failure to report data breaches promptly and take appropriate security measures can lead to fines and lawsuits. For example, in 2018, British Airways suffered a data breach that affected approximately 500,000 customers. The company faced regulatory investigations and received a fine from the UK Information Commissioner’s Office (ICO) under GDPR.

Operational costs

When ransomware locks critical files, core servers, or network systems, operations stop immediately. Frontline personnel cannot access customer sales platforms, HR databases, or supply chain management software, which causes core processes to stall. Even brief operational freezes trigger a domino effect of delayed order fulfillments, missed service-level agreements, and canceled contracts.

An extended operational blackout translates directly into revenue shortfalls, contract penalties, and reputational fallout. In situations like this, clients tend to migrate to competitors that seem more reliable, so the true cost of ransomware extends far beyond immediate downtime.

Ransomware prevention: how to protect yourself 

A successful ransomware prevention model involves proactive measures. These measures include:

• Regular data backups. The ransomware attack will not be effective if the victim maintains access to their data after the breach. This is why it’s important to have a secure data backup solution, such as SaaS-based system recovery tools, so that the data lost to a ransomware attack is minimal or non-existent. It’s crucial that the criminals can’t encrypt the backup data. Store it in a read-only format that ransomware cannot alter. Keep backups offline or in a secure cloud environment, enable versioning to retain multiple file copies, and test backups periodically to confirm their integrity.
• Employee training and cybersecurity awareness. Regular cybersecurity awareness training helps to diminish your company’s vulnerability to ransomware. Teach your employees to:
  • Never click on suspicious links.
  • Never open suspicious or unexpected attachments.
  • Never reveal personal or sensitive data to unverified individuals.
  • Verify software legitimacy before downloading it.
  • Never use unknown USB drives.
  • Use a VPN when connecting to a public or unprotected Wi-Fi network.
• User authentication and access control. Implement secure user authentication methods, such as multi-factor authentication (MFA), and strong access controls. Pair MFA with the principle of least privilege (giving team members access only to the specific files and systems they need for their roles) to keep an infected account from compromising the entire company.
• Security software and patch management. Antivirus and antimalware software, endpoint detection and response solutions, email security gateways, and browser security extensions help prevent ransomware attacks. Timely software updates and patches fix software vulnerabilities that cybercriminals might exploit. Updates keep your security tools and operating system current on the latest threats, so they catch new ransomware variants as well as old ones.
• Advanced cybersecurity tools and network monitoring. Modern ransomware moves fast, so basic signature matching isn’t always enough. NordVPN’s next-generation antivirus catches threats in real time — preventing scams, phishing, and malware. Pairing this with continuous network monitoring lets security teams flag suspicious internal traffic before a breach escalates.
• Zero Trust architecture. Adopt a “never trust, always verify” mindset and back it with solid cyber hygiene. Zero Trust continuously authenticates every user, device, and request, regardless of where it originates. Segmenting your network creates internal barriers, so an infected endpoint is much less likely to take down your other systems.
• Cyber incident response plan. When an attack hits, speed and clarity matter. Having a practical, tested response plan specifically for ransomware gives your team clear steps to isolate infected devices, revoke credentials, and contain the damage quickly. Regular tabletop exercises keep your team ready, cutting downtime and stress when an attack lands.

How to respond to a ransomware attack 

First, confirm it’s not simply scareware or other malware you are dealing with. If it really is ransomware, take the following steps to handle the incident: 

1. 1. Isolate the infected system. Immediately disconnect the infected device from the network (Wi-Fi, Ethernet, and Bluetooth) to prevent the ransomware from spreading. 
2. 2. Do not pay the ransom. Payment offers no guarantee of data recovery or non-disclosure and fuels criminal operations. Additionally, making payments to sanctioned entities may violate trade regulations, such as the U.S. Department of the Treasury OFAC sanctions.
3. 3. Report the incident. Notify your organization’s IT or security team, your local law enforcement agencies, and federal authorities by filing a report with the FBI’s Internet Crime Complaint Center (IC3). 
4. 4. Assess the impact. Evaluate the scope of the attack, identifying which systems, endpoints, cloud environments, and sensitive data repositories have been affected.
5. 5. Meet data breach notification obligations. Comply with applicable regulatory, industry, and legal deadlines for notifying affected customers, regulators, and stakeholders regarding data exposure.
6. 6. Recover data from clean backups. Rebuild compromised systems and restore operational data using verified, uncorrupted, and isolated offline backups.
7. 7. Remediate, patch, and harden defenses. Remove any remaining malware and attacker access, patch the vulnerabilities they used, and tighten your defenses against reinfection.

How to remove ransomware

Here are the steps both individuals and organizations can take to remove ransomware from their systems:

• Isolate the infected device(s). As mentioned in sections before, make sure to disconnect affected devices from all wired and wireless connections — the internet, local networks, phones, flash drives, external drives, and cloud storage — to stop the ransomware from spreading. Check whether connected devices are also infected.
• Determine the type of ransomware. Knowing which ransomware strain affected your device can help you remove it. You may need a cybersecurity professional or a ransomware identification tool such as ID Ransomware.
• Remove the ransomware. Check if the ransomware is still on your device, because sometimes it deletes itself after a successful infection. If it’s still there, use anti-malware or anti-ransomware software to quarantine or remove the malware. Manual removal is difficult, so bring in a security professional to locate and delete the ransomware file.
• Restore from backup. If you have clean and up-to-date backups, use them to restore your system to its pre-infection state. Ensure that your backups are free from malware.

What is the future of ransomware?

Ransomware is transitioning from simple file encryption into AI-driven digital extortion. According to ESET, the discovery of PromptLock marks a turning point opens in a new tab — ransomware is starting to use built-in AI models to write its own attack scripts on the fly. Instead of relying on rigid, pre-written code, future threats will be able to inspect a target system and decide in real time how best to steal or encrypt data, whether it’s running on a standard PC, a server, or industrial machinery. Because the AI writes fresh code on every run, signature-based security tools won’t recognize it. This makes attacks much easier for less technical hackers to pull off, forcing defenders to shift toward AI-driven behavioral monitoring to catch these unpredictable threats before the damage is done.

Cyberattacks increasingly hit the services people depend on every day — hospitals, power grids, and the accounts that hold their lives together. Individuals and organizations must implement Zero Trust principles, multi-factor authentication (MFA), continuous patching, and offline, immutable backups to prevent catastrophic operational and financial loss.