Security fundamentals

What Is Ransomware? How It Works and What to Do

Ransomware is malware that encrypts files on a device so the files, and the systems that depend on them, become unusable until the attacker is paid for decryption (CISA's definition). Many attackers also steal data and threaten to leak it, which is why backups alone are not a full answer.

This guide summarises the joint #StopRansomware Guide from CISA, the FBI, the NSA and MS-ISAC. For hands-on practice, try the ransomware tool. General information, US-centred, not legal advice.

Updated 3 November 2026

How a ransomware attack works

Attackers first get a foothold, then encrypt files, often after stealing data. CISA's guide lists the common ways in:

Internet-facing vulnerabilities and misconfigurations
Compromised credentials
Phishing
Precursor malware infection
Advanced forms of social engineering
Third parties and managed service providers

Because of data theft, a leak-site listing of a company name is a claim by the criminals, not confirmation. See our worked example.

How to reduce the risk

Best practices from the CISA guide (see the source for the full list):

Keep offline, encrypted backups of critical data and test them regularly.
Create, maintain and exercise an incident response plan and a communications plan.
Patch software, scan for vulnerabilities and disable unneeded remote services such as RDP.
Use phishing-resistant multifactor authentication, least privilege and unique passwords of at least 15 characters.
Filter email, disable macros and implement DMARC.
Use centrally managed antivirus, allowlisting or EDR to catch precursor malware.
Segment networks, secure domain controllers and centralise logging.
Adopt zero trust architecture to limit access to data and services.

Measure yourself with the readiness scorecard, or rehearse with a tabletop exercise.

If you are hit

The guide's response checklist has four parts: Detection and Analysis, Reporting and Notification, Containment and Eradication, and Recovery and Post Incident Activity. Our response guide expands each, and the family identification guide and ransom note interpreter help you understand what you are facing.

Report it

CISA's page says victims should report to federal law enforcement via IC3 (ic3.gov) or a Secret Service field office, and can request technical assistance from CISA at cisa.gov/report, Central@cisa.gov or 1-844-729-2472. State, local, tribal and territorial entities can also contact MS-ISAC.

Paying

The FBI's 2019 public service announcement says it does not advocate paying a ransom, in part because payment does not guarantee access to data, and urges you to report incidents whether or not you pay. CISA's guide also advises consulting federal law enforcement about possible decryptors before acting. Read how to decide whether to pay a ransom and speak to counsel.

Last reviewed 3 November 2026. We quote no loss or frequency statistics here because we did not verify a current primary source for them.

Frequently asked questions

What is ransomware?

CISA describes ransomware as malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable. Attackers then demand a ransom for decryption. Many also steal data first and threaten to release it, which CISA’s guide calls double extortion.

How does ransomware get in?

The #StopRansomware Guide lists these common initial infection vectors: internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, precursor malware infection, advanced forms of social engineering, and third parties and managed service providers.

How do I prevent a ransomware attack?

CISA’s best practices include offline, encrypted backups that you test; a tested incident response plan; patching and disabling unneeded remote services such as RDP; phishing-resistant multifactor authentication and least privilege; email filtering and DMARC; endpoint detection or allowlisting; and network segmentation with centralised logging.

Should we pay the ransom?

The FBI has said it does not advocate paying a ransom, partly because payment does not guarantee you regain access to your data (IC3 PSA, 2 October 2019). Payment can also raise legal and sanctions questions that depend on the facts; get legal advice. Our guide on that decision walks through the considerations.

Who do I report ransomware to?

CISA’s guide says to report to federal law enforcement via the FBI Internet Crime Complaint Center (ic3.gov) or a Secret Service field office, and you can contact CISA at cisa.gov/report or 1-844-729-2472 for technical assistance. The FBI urges reporting whether or not you pay.

Is ransomware only an enterprise problem?

No. It affects individuals and organisations of any size. The prevention steps that matter most for a small organisation or household are backups kept offline, patching, unique passwords with multi-factor sign-in, and care with email attachments and links.

What is double extortion?

Attackers both encrypt systems and threaten to sell or leak exfiltrated data or authentication information if the ransom is not paid, per CISA’s Ransomware 101 page. Restoring from backup then does not remove the data-leak pressure.