Home / Knowledge hub / Ransomware
Knowledge hub
Ransomware
Malware that locks your data and demands payment to unlock it.
What it means
Ransomware is malicious software that makes your data or systems unusable, usually by encrypting files, and then demands payment for the key. Newer attacks often steal a copy of the data first and threaten to publish it. The payment is demanded in exchange for restoring access.
That second step is why it is called double extortion. Restoring from a backup may fix the locked files, but it does not undo a leak. The attacker holds two levers: your downtime, and your customers' private information. Plan for both problems, not only the locked files.
Why it matters
The cost is rarely the ransom. It is the days of stopped work, the lost sales, the clean-up, the legal duties after a data breach, and the customers who leave. Small and mid-sized software businesses are not too small to be chosen.
Official advice from agencies such as CISA is to prepare rather than to hope: keep offline, tested backups, limit what each account can reach, and have a plan. Paying does not guarantee you get the data back, and it can mark you as willing to pay.
How it shows up
Attackers get in through phishing emails, stolen or guessed passwords, exposed remote access, and unpatched internet-facing software. From the first foothold they spread, find backups, and encrypt. Weaknesses in a web application, such as remote code execution, can also be the way in.
The mistakes are consistent: backups on the same network that the attacker can reach, no tested restore, broad admin rights, and no practice. Keep a copy offline or immutable, test a full restore, and rehearse with a tabletop exercise. Plan who decides, who talks to customers and who calls your insurer.
Questions people ask
Ransomware, answered
Should we pay the ransom?
Authorities generally advise against it. Payment funds the next attack, and there is no guarantee that the data will be returned or that it has not been copied.
Take legal advice and involve your insurer and the relevant authorities before any decision.
Do backups protect us from ransomware?
They protect against loss of data, if they are intact and tested. Attackers often look for backups and delete or encrypt them first.
Keep at least one copy offline or immutable, and practise a full restore.
How does ransomware get into a company?
Most often through phishing, weak or reused credentials, exposed remote access services, and software that has not been patched. Web application flaws are another route.
Closing those entrances reduces the chance more than any single tool.
Is ransomware a data breach?
It can be. If data was copied or could have been viewed by the attacker, many laws treat it as a breach with notice duties. Encryption alone may also count when data is lost or unavailable.
Check the rules that apply to you early.
Can ransomware be stopped once it starts?
Sometimes it can be slowed. Quick containment, such as isolating machines and disabling accounts, can limit the number of systems locked.
Speed depends on knowing what normal looks like in your logs.
Sources
Where this comes from
Related
Terms that sit next to this one
Malware
Software built to damage systems, steal data or give an attacker control.
Containment
Limiting an incident's spread first, before the clean-up starts.
Backup integrity
Knowing your backups are complete, untouched and actually restorable.
Business continuity
Keeping critical services running, or restoring them fast, through a disruption.
Phishing
Persuading someone to hand over credentials by posing as a trusted sender.
Is your front door really locked?
Ransomware often arrives through a weakness that could have been found earlier. We find vulnerabilities in your web apps and APIs and prove each one, so the entrance gets closed first. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.