What Is Ransomware? How It Works and How to Survive It (2026)

Of all the ways a computer can be compromised, ransomware is the one that hits hardest and fastest: one moment your files are fine, the next they’re scrambled and a note demands payment. It’s a multi-billion-dollar criminal industry, and it targets individuals as readily as hospitals. This guide explains what ransomware is, how an attack unfolds, why paying is a trap, and the single defence that genuinely works.

What ransomware is

Ransomware is a type of malware that encrypts your files — documents, photos, whole drives — and demands a ransom (usually in cryptocurrency) for the decryption key. Some variants also steal a copy of your data first and threaten to leak it (“double extortion”) to pressure you further.

The cruelty of it is simple: it doesn’t need to break your encryption or steal your identity. It just locks you out of your own data and charges you to get back in.

How an attack unfolds

1. Entry — usually via phishing (a malicious attachment or link), a compromised download, or an unpatched, internet-exposed service.
2. Execution & spread — the malware runs, often quietly escalating privileges and spreading across drives and network shares.
3. Encryption — it encrypts your files with a key only the attacker holds, then drops a ransom note.
4. Extortion — pay (in crypto) for the key, or lose the data — and with double extortion, risk a leak too.

The whole sequence can complete in minutes, faster than you can react.

Why paying is a bad bet

Paying funds the criminal industry, marks you as someone who pays (inviting repeat attacks), and guarantees nothing: decryptors are sometimes broken or never sent, and data already exfiltrated can still be leaked. Law-enforcement guidance is consistent — avoid paying, and report the incident. The only reliable recovery is restoring from a clean backup.

The one defence that works: backups it can’t reach

You can reduce the chance of infection (patch everything, don’t run unknown files, use least privilege, keep email skepticism high). But the only thing that lets you recover is a backup ransomware can’t encrypt:

• Follow the 3-2-1 rule: 3 copies, on 2 types of media, 1 kept offsite/offline.
• An offline or immutable backup is key — ransomware encrypts everything it can write to, so a permanently connected drive or always-mounted cloud can be hit too.
• Test that you can actually restore.

Isolation reduces the blast radius

Security-focused systems limit how far ransomware can spread. Compartmentalising apps (as Qubes OS does) and running sensitive work on an amnesiac system like Tails means a compromise in one place can’t reach everything. Full-disk encryption protects data at rest from theft, though note it does not stop ransomware — your unlocked, running system can still be encrypted on top.

The bottom line

Ransomware is malware that encrypts your files and demands payment — fast, lucrative, and indiscriminate. Don’t count on prevention alone, and don’t pay: the only dependable recovery is a backup it can’t reach, kept offline or immutable under the 3-2-1 rule. Reduce the odds with patching, least privilege and phishing awareness, limit spread with isolation — but the backup is what saves you.

Editorial guide based on how ransomware works (encryption-for-ransom, double extortion) and standard defence (3-2-1 backups, offline/immutable copies, isolation). The commercial link carries the rel=“sponsored nofollow” attribute; an affiliate commission may apply at no extra cost to you.