What is ransomware?

The term "ransomware" refers to malware that encrypts your systems, networks or computer files and renders them unusable. Then the bad actors behind the cyberattack demand a ransom for decrypting them.

There are many types of ransomware out there, with new variations being developed all the time. Some are designed to shut down access to computer systems completely, while others encrypt files while leaving access to the system or network intact. Still other ransomware attacks threaten to release proprietary information to the public if the ransom is not paid.

Ransomware attacks have become increasingly common, thanks to the creativity and technical savvy of the attackers.

Bad actors often use stolen credentials to gain access to a network to wreak their havoc on both individuals and organizations. Weak credentials, such as simple passwords used for multiple accounts, make it easy for hackers to access someone’s accounts or systems. Lost or stolen devices, especially those that are left unlocked and unencrypted, also provide scammers with an entry point.

Another extremely common way for ransomware to infiltrate a computer is through phishing emails. Cybercriminals increasingly use artificial intelligence (AI) to create convincing phishing emails, text messages and other communications that imitate trusted organizations, making ransomware attacks more difficult to detect.¹ In this kind of attack, scammers send official-looking emails or texts to individuals, encouraging them to click on a link or open an attachment.

These communications may look like they’re really from the recipient’s bank, credit card company or other legitimate entity, when they’re simply Trojan horses for ransomware. When the unsuspecting party clicks on a link or downloads the attachment, malware infects their computer, and the damage begins.

There are some simple things you can do to avoid a ransomware attack. First, make sure to regularly update your operating system on your devices and any other software you use. These updates will help protect you and your data from the latest cyberattacks. Enable multi-factor authentication (MFA) whenever available, particularly for email, financial and other important accounts. MFA can help prevent attackers from gaining access even if credentials are compromised.

Then, be careful with your incoming email. Don’t click on links or attachments from senders you don’t know. Be sure to take a closer look at emails that appear to be from someone you do know, too, as cybercriminals have become extremely skilled at copying the look and feel of legitimate emails. When in doubt, look at the sender’s complete email address. Check the sender's email address carefully and be cautious of unexpected links, attachments or requests for sensitive information. While suspicious email addresses can still be a warning sign, modern phishing messages are often professionally written and may appear legitimate. When in doubt, verify the request through a trusted source before responding.

It's also important to regularly back up important files and data. Consider maintaining secure backups that are stored separately from your primary device or network. If ransomware encrypts your files, backups may help you recover your data without paying a ransom.

If you believe you may by the victim of a ransomware attack, the FBI recommends you report the ransomware attack to the proper authorities:

• Contact your local FBI field office to request assistance, or submit a tip online.
• File a report with the FBI’s Internet Crime Complaint Center (IC3).
• Report incidents, phishing, malware or vulnerabilities to the Cybersecurity and Infrastructure Security Agency.
• If possible, disconnect affected devices from the internet and your network to help prevent the ransomware from spreading to other systems or shared drives.

[1] "Cost of a Data Break Report 2025," IBM Security. www-api.ibm.com (2025)