Ransomware is malicious software that locks your files, or threatens to leak them, and then demands payment to undo the damage. The ransomware basics for everyday users come down to a few habits rather than clever technology: keep regular backups that the infected computer cannot reach, keep software updated, and be careful with attachments and links.
What ransomware actually does
Once ransomware runs on a computer, it typically encrypts documents, photos and other files so you cannot open them. A message then appears explaining how to pay to get them back. Some attackers also copy your data first and threaten to publish it, which adds pressure even if you have a backup.
Anyone can be a target. Criminals often spread ransomware widely and cheaply rather than choosing victims, so a home laptop is as plausible a target as a company server.
How ransomware gets onto devices
Most infections begin with an ordinary mistake or an unpatched weakness rather than something exotic.
- Phishing emails with attachments or links that install malware. Our guide to spotting phishing emails covers the warning signs.
- Software with known flaws that has not been updated.
- Pirated or cracked programs and files from untrustworthy download sites, which are a common hiding place for malware.
- Malicious adverts or fake download pages that imitate real software.
- Weak or reused remote-access passwords, which let attackers log in rather than break in.
- Infected USB drives plugged into a computer.
Ransomware basics: how to prepare
Preparation matters far more than reaction. If you can restore your files from a clean copy, a ransomware attack becomes an inconvenience rather than a disaster.
Back up in a way ransomware cannot reach
A backup that stays permanently plugged into your computer can be encrypted along with everything else. Aim for at least one copy that is disconnected or protected from changes. A widely used rule of thumb is three copies of your data, on two kinds of storage, with one kept somewhere else. In practice that might mean your computer, an external drive you unplug after backing up, and a cloud backup that keeps older versions of files.
Whatever you choose, test it. Try restoring a few files now and then, because an untested backup is only a hope.
Keep everything updated
Many attacks use flaws that the software maker has already fixed. Turning on automatic updates for your operating system, browser and apps closes those doors for you. We explain this in more detail in why software updates matter.
Reduce what an attacker can do
- Use a standard account for daily work and an administrator account only when installing something.
- Keep built-in security tools such as your system’s antivirus switched on.
- Use unique passwords and a second factor on important accounts, including your cloud storage.
- Turn off remote-access features you do not use.
- Only install software from official sources.
Warning signs of an infection
Sometimes the first clue is a ransom note, but there may be earlier hints. Files might suddenly fail to open, have strange new extensions or have been renamed. Your computer may slow down noticeably as it encrypts files. You might spot unknown programs or find that your security software has been turned off.
If you notice these things, act at once. Speed can limit how many files are affected.
What to do if you are hit
- Disconnect the device from Wi-Fi, cables and any shared drives to stop the spread. Powering the device off afterwards is fine if you are unsure what else to do.
- Do not pay immediately. Payment does not guarantee your files will be returned, and it may encourage further attacks. Whether to pay is your decision, and in some places laws or regulations may apply, so check what applies where you live.
- Take a photo of the ransom message and note any details shown. This helps when you seek advice.
- Change passwords from a different, clean device, starting with email and financial accounts.
- Report the incident to your workplace IT team if the device is a work one, and to the relevant authorities or cyber-crime reporting service in your country.
- Look for legitimate help. Security organisations and law enforcement sometimes publish free recovery tools for certain ransomware families. Search carefully, because fake recovery services also exist.
- Clean and restore. Once the malware is removed, ideally by a professional or by reinstalling the system, restore files from your backup.
If your data was stolen as well
Treat it like any other leak. Our article on what to do after a data breach lists sensible next steps for accounts and identity protection.
Myths worth dropping
- “It only happens to businesses.” Individuals are affected too.
- “My Mac or phone cannot catch it.” Fewer attacks target them, but no platform is immune.
- “Paying always solves it.” It does not, and recovery tools can be faulty even when attackers provide them.
- “Antivirus is enough on its own.” It helps, but backups and updates matter just as much.
You will find more everyday protection advice in our cybersecurity section.
Where to start
Begin with a backup. Copy your most important files to an external drive or an online backup, then disconnect the drive. Next, switch on automatic updates. Those two steps take less than an hour and do more against ransomware than anything else you can do today.
Frequently asked questions
What is ransomware in simple terms?
It is malware that locks your files or threatens to leak them and demands payment. Regular offline backups let you recover without giving in.
Should I pay the ransom?
Payment does not guarantee you will get your files back and may encourage more attacks. Seek advice first and check the rules that apply where you live.
Can ransomware infect phones and Macs?
Yes, though attacks on them are less common than on Windows computers. Updates, careful downloads and backups help on every platform.
What is the best protection against ransomware?
A tested backup stored where the infected device cannot reach it, combined with automatic updates and caution around email attachments and links.
