This is ransomware — malware that encrypts your files and demands payment to unlock them. Hospitals, schools, businesses, and regular people lose billions annually to these attacks.
The worst part? Paying doesn’t guarantee you’ll get your files back. Here’s how ransomware works, how to avoid it, and what to do if you’re already infected.
How ransomware infects your device
1. Phishing emails with malicious attachments
You receive an email: “URGENT: Invoice attached” or “Your package couldn’t be delivered.” You open the attachment (PDF, Word doc, ZIP file), and ransomware silently installs.
Red flags:
- Unexpected attachments from unknown senders
- Generic greetings (“Dear Customer” instead of your name)
- Urgency tactics (“Action required within 24 hours”)
- Spelling errors and poor grammar
2. Malicious links in emails or text messages
A text: “Your bank account has been locked. Click here to verify.” The link downloads ransomware disguised as a legitimate app or update.
3. Fake software updates
A pop-up appears: “Your Flash Player is out of date. Update now.” You click “Update” and install ransomware instead.
Real software updates never come via random pop-ups.
4. Drive-by downloads from compromised websites
You visit a hacked website (even legitimate ones get compromised). JavaScript on the page exploits a browser vulnerability and downloads ransomware without you clicking anything.
5. Malicious ads (malvertising)
Even trusted websites serve third-party ads. If an ad network is compromised, clicking an ad — or even just viewing the page — can trigger a download.
What happens when ransomware activates
- Silent encryption: Ransomware scans your hard drive for valuable files (documents, photos, videos, databases) and encrypts them using military-grade encryption (AES-256 or RSA-2048).
- Ransom note appears: Your desktop wallpaper changes to a ransom demand. Instructions tell you how much to pay (usually $500-$10,000 in cryptocurrency).
- Countdown timer: “Pay within 72 hours or the price doubles. Wait longer and we delete the decryption key forever.”
- Disabled recovery: Advanced ransomware deletes backup copies, shadow copies, and system restore points so you can’t recover files manually.
Real ransomware attacks
WannaCry (2017)
Infected over 300,000 computers in 150 countries. Hit hospitals, forcing surgeries to be canceled. Spread via a Windows vulnerability (EternalBlue) leaked from the NSA.
Damage: $4 billion globally.
NotPetya (2017)
Disguised as ransomware but actually designed to destroy data. Crippled shipping giant Maersk, costing them $300 million. FedEx lost $400 million.
Colonial Pipeline (2021)
Ransomware shut down a major US fuel pipeline for 6 days, causing gas shortages across the East Coast. Company paid $4.4 million ransom (FBI later recovered $2.3 million).
Kaseya (2021)
Attackers compromised software used by IT companies, infecting 1,500+ businesses worldwide. Ransom demand: $70 million.
Should you pay the ransom?
FBI and cybersecurity experts say: No.
Why you shouldn’t pay:
- Paying funds criminal organizations (they use the money to develop better ransomware)
- No guarantee you’ll get your files back (30% of victims who pay still lose data)
- Some ransomware is buggy — even with the key, decryption might fail
- You become a target for future attacks (they know you’ll pay)
When people do pay:
- Critical business data with no backups (hospitals, law firms, manufacturers)
- Irreplaceable personal files (family photos, legal documents)
- Deadline pressure (business can’t afford downtime)
Reality: 43% of ransomware victims pay the ransom (Sophos 2023 report).
How to protect yourself from ransomware
1. Backup everything (3-2-1 rule)
The only guaranteed protection is having backups ransomware can’t reach.
3-2-1 Backup Rule:
- 3 copies of your data (original + 2 backups)
- 2 different media types (e.g., external drive + cloud)
- 1 off-site backup (cloud or physically separate location)
Critical: Disconnect external drives after backing up. Ransomware encrypts connected drives too.
Cloud backup services: Backblaze, Carbonite, Google Drive, Dropbox (enable file versioning)
2. Use antivirus with ransomware protection
Modern antivirus software detects ransomware behavior (mass file encryption) and blocks it before damage occurs.
Best protection: Bitdefender Antivirus — includes advanced ransomware remediation that restores encrypted files.
Features to look for:
- Real-time ransomware protection
- Behavioral detection (spots encryption activity)
- Ransomware remediation (automatic file recovery)
- Web protection (blocks malicious downloads)
3. Keep software updated
WannaCry spread because people didn’t install a Windows security patch released two months earlier.
Enable automatic updates for:
- Operating system (Windows, macOS, Linux)
- Web browsers (Chrome, Firefox, Edge, Safari)
- Adobe Reader, Flash (or better yet, uninstall Flash)
- Java
- All installed applications
4. Don’t click suspicious links or attachments
Before clicking any link:
- Hover over it to see the real URL (does it match the claimed destination?)
- Check the sender’s email address (not just the display name)
- If unexpected, contact the sender through a different channel to verify
Before opening attachments:
- Scan with antivirus first
- Be suspicious of .exe, .zip, .scr, .bat files
- Even Word docs and PDFs can contain macros that install malware
Tool: Email Header Analyzer — verify email authenticity.
5. Disable macros in Office documents
Many ransomware attacks use malicious macros in Word/Excel files.
How to disable:
- Word/Excel: File → Options → Trust Center → Trust Center Settings → Macro Settings → “Disable all macros with notification”
Only enable macros for files from trusted sources.
6. Use a firewall
A firewall blocks unauthorized network connections that ransomware uses to spread or communicate with command servers.
Enable built-in firewalls:
- Windows: Control Panel → Windows Defender Firewall → Turn on
- Mac: System Preferences → Security & Privacy → Firewall → Turn On
Related: What Is a Firewall and How Does It Work?
7. Secure your network
Ransomware often spreads laterally across networks (from one device to all connected devices).
Network security checklist:
- Strong Wi-Fi password (WPA3 or WPA2)
- Disable remote desktop (RDP) if not needed
- Segment network (IoT devices on separate network)
- Change default router credentials
Guide: How to Secure Your Home Network
8. Use a VPN on public Wi-Fi
Public Wi-Fi is a common attack vector. A VPN encrypts your connection, preventing attackers from injecting malware.
Recommended VPNs:
- PureVPN — Military-grade encryption, 6,500+ servers
- IPVanish — Unlimited connections, perfect for families
Test your VPN: Check for leaks
9. Enable Windows controlled folder access
Windows 10/11 has a built-in ransomware protection feature that blocks unauthorized apps from modifying files in protected folders.
Enable it:
- Settings → Update & Security → Windows Security → Virus & threat protection
- Manage ransomware protection → Controlled folder access → Turn on
- Add important folders to protected list
10. Educate everyone in your household/business
Ransomware targets the weakest link — often the least tech-savvy person.
Basic training:
- Never open unexpected attachments
- Don’t click links in unsolicited emails
- Verify requests for urgent action or money transfers
- Report suspicious emails to IT (businesses) or delete immediately (home)
What to do if you’re infected
Step 1: Disconnect from the internet immediately
Unplug ethernet cable or turn off Wi-Fi. This stops ransomware from:
- Spreading to other devices on your network
- Encrypting cloud-synced files
- Communicating with command servers
Step 2: Don’t pay (yet)
Take a breath. Many ransomware strains have been cracked, and free decryption tools exist.
Step 3: Identify the ransomware variant
Upload the ransom note or an encrypted file to NoMoreRansom.org — a project by Europol that identifies ransomware and provides free decryption tools for certain strains.
Step 4: Check for decryption tools
Search for “[ransomware name] decryption tool” — Emsisoft, Kaspersky, and Avast have released decryptors for many variants.
Step 5: Restore from backups
If you have clean backups:
- Wipe the infected system completely (reformat and reinstall OS)
- Scan backup drives with antivirus before restoring
- Restore files from the backup taken before infection
Step 6: Report to authorities
File a report with:
- FBI Internet Crime Complaint Center (IC3): IC3.gov
- Local law enforcement
They likely won’t recover your files, but reporting helps track cybercrime trends.
Step 7: If all else fails and you must pay
As a last resort:
- Hire a professional ransomware negotiation firm (they often get better rates)
- Document everything (ransom note, communications, payment)
- Report payment to authorities (for tax and legal purposes)
Ransomware myths debunked
Myth 1: “Only big companies get targeted”
False. 71% of ransomware attacks target small businesses. Individuals get hit too — especially those with poor security.
Myth 2: “Macs don’t get ransomware”
False. While less common, Mac-targeting ransomware exists (KeRanger, EvilQuest). macOS users should still use antivirus and backups.
Myth 3: “Antivirus is enough”
Partially true. Antivirus catches most ransomware, but not all (especially zero-day attacks). Backups are essential.
Myth 4: “If I pay, I’ll get my files back”
False. 30% of victims who pay never receive a working decryption key. Some ransomware is poorly coded and can’t decrypt even if you pay.
Frequently Asked Questions
Can ransomware spread through email just by opening it?
No, usually you need to open an attachment or click a link. However, some email clients with HTML rendering vulnerabilities have been exploited without user interaction (rare).
Will factory resetting my device remove ransomware?
Yes, but you’ll lose all data. Ransomware encrypts files, so resetting removes both the malware and your encrypted files. Only do this if you have backups.
Can ransomware infect my phone?
Yes. Android ransomware exists (usually from third-party app stores). iOS is more resistant but not immune. Mobile ransomware typically locks the screen rather than encrypting files.
How long does ransomware encryption take?
Depends on file count and encryption method. Some variants encrypt thousands of files in minutes. Others take hours. Fast encryption helps ransomware avoid detection.
Can I negotiate with ransomware attackers?
Technically yes — some victims successfully negotiate lower amounts. Professional ransomware negotiators exist for this purpose. However, you’re still funding criminals.
Does ransomware delete files or just encrypt them?
Most encrypt files and keep the encrypted copies. Some wiper malware (like NotPetya) deletes data entirely, making recovery impossible even if you pay.
Bottom line: Backups are your only guarantee
Ransomware is a when, not if threat. You can do everything right and still get infected via a zero-day exploit or compromised website.
The only defense that never fails: backups.
Protect yourself now:
- ✅ Set up automatic backups (cloud + external drive)
- ✅ Install antivirus: Bitdefender
- ✅ Enable Windows controlled folder access
- ✅ Update all software
- ✅ Use a VPN on public Wi-Fi: PureVPN or IPVanish
Additional tools:
Ransomware doesn’t care about your data. Attackers just want money. Protect yourself before they come knocking.