What Is Ransomware and How Can You Protect Yourself?

Ransomware is malicious software that encrypts your files, or locks your device, and then demands money to restore access. It affects individuals, schools, hospitals and companies of every size.

How it spreads

• Phishing emails with infected attachments or links.
• Downloads from untrusted sites or pirated software.
• Unpatched software with known weaknesses.
• Weak or stolen remote-access passwords.

Warning signs

Files suddenly have strange extensions, cannot be opened, or a message appears demanding payment. If you see this, disconnect the device from the network immediately to stop the spread.

Protect yourself

• Keep regular backups, with at least one copy offline or in a separate cloud account.
• Install system and app updates promptly.
• Use reputable security software.
• Do not open unexpected attachments, and check links before clicking.
• Use strong unique passwords and two-factor authentication.

Should you pay?

Authorities generally advise against paying. There is no guarantee you will get your files back, and payment encourages more attacks. Report the incident to the police or your national cyber agency, and ask a professional for help.

After an attack

Restore from a clean backup after the malware has been removed, change your passwords, and find out how the attacker got in. Backups are your best insurance, so test them before you need them.