What Is Ransomware? How It Works and How to Protect Yourself

What ransomware is

Ransomware is malicious software that takes your data hostage. Once it infects a device or network, it encrypts your files, documents, photos, databases, so you can no longer open them, then displays a demand for payment (usually in cryptocurrency) in exchange for the decryption key. Some strains also steal a copy of your data first and threaten to leak it publicly unless you pay, a tactic called 'double extortion.' It has grown from a nuisance into a massive criminal industry that has hit hospitals, pipelines, schools, and businesses worldwide.

How it gets in

Ransomware usually enters through a few well-worn doors. Phishing is the most common: a malicious email attachment or link that installs the malware when opened. Others include exploiting unpatched software vulnerabilities, weak or stolen remote-access (RDP) credentials, and malicious downloads. Once on one machine, sophisticated ransomware spreads laterally across a network, encrypting as many systems as possible before revealing itself, which is why a single click can take down an entire organization.

Why paying is a bad bet

When your files are locked, paying can feel like the only option, but authorities and security experts broadly advise against it. There is no guarantee you get a working key (some victims pay and recover nothing), paying funds and encourages more attacks, marks you as a willing payer for the future, and, with double extortion, does not actually ensure the stolen copy is deleted. Payment also may carry legal risk if the group is sanctioned. The far better position is to never need the key, because you have backups.

Backups: your real defense

The single most effective protection against ransomware is good backups, because if your files are safely copied elsewhere, encryption becomes an inconvenience rather than a catastrophe: you wipe and restore. Follow the 3-2-1 rule: three copies of your data, on two different media, with one kept offline or offsite. The offline part is crucial, ransomware tries to encrypt connected backups too, so a backup that is disconnected (or immutable/versioned cloud storage) is what actually saves you. Test that your backups restore, an untested backup is a hope, not a plan.

Preventing infection

Backups are the safety net; these habits reduce the chance you need it. Keep your operating system and software updated (patches close the holes ransomware exploits). Be extremely cautious with email attachments and links, most attacks start with phishing. Use reputable security software. Enforce strong, unique passwords and two-factor authentication, especially on any remote access. Limit user permissions so malware cannot spread freely. For organizations, network segmentation and staff training are essential. Most ransomware relies on a preventable mistake.

If you get hit

If ransomware strikes: disconnect the affected device from the network immediately to stop it spreading, do not pay reflexively, and seek help. Report it to the relevant authorities (many countries have cybercrime reporting channels), and check resources like the No More Ransom project, which offers free decryptors for some known strains. Then restore from your clean, offline backups after fully removing the malware. For businesses, have an incident-response plan ready before you need it, the middle of an attack is the worst time to improvise.

Related on Skillo

See also: What is phishing and how to avoid it, Self-hosting for beginners (backups).

Sources

• Ransomware - Wikipedia

Published date reflects the original event date (2026-01-28). This article is original Skillo editorial written from the sources above; facts were verified in September 2026.