What it is
Ransomware is malicious software that locks or encrypts your files and systems, then demands a payment to unlock them. Attackers increasingly also steal data first and threaten to publish it. For a business, government office or hospital it can halt operations entirely, which is why preparation matters more than any single tool.
How it gets in
A phishing message with a malicious attachment or link.
An exposed or unpatched internet-facing system, or weak remote-access credentials.
A compromised password reused across accounts, or an infected device brought onto the network.
How to reduce the risk
Keep offline, tested backups so you can recover without paying. Patch systems promptly, protect every account — especially administrators — with multi-factor authentication, segment networks to limit spread, and restrict administrative access. Our guidance on resilience, backup and recovery and baseline controls covers this in depth.
If you are hit
Isolate affected devices from the network and from backups, but do not immediately wipe them — preserve evidence and logs.
Do not rely on paying the ransom: payment does not guarantee recovery and funds further crime.
Recover from clean, trusted backups after confirming the systems are no longer compromised.
Report the incident to the relevant national authority and through our reporting guidance.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.