Ransomware explained for ordinary people and small businesses

What ransomware is

Ransomware is a type of malicious software that locks or encrypts your files so you cannot open them, and then demands payment, usually in cryptocurrency, to unlock them. Your photos, documents and business records are still on the device. They are simply scrambled, and the criminals hold the only key.

Many modern gangs do a second thing as well. Before they lock anything, they quietly copy your data. Then they threaten to publish it if you do not pay. This is called “double extortion”. It means even a perfect backup does not fully solve the problem, because the stolen data is still out there.

How it gets in

Ransomware does not appear by magic. Someone has to let it in, or a door has to be left open. The common routes are:

• Phishing emails and messages with a malicious attachment or link. Our phishing email checker shows the warning signs.
• Stolen or weak logins on email, remote desktop or other remote-access services, with no second step to stop the thief. This is the route in many big attacks. In the 2024 Change Healthcare attack, for example, attackers logged in to a remote-access portal that, in the company’s own words, did not have multi-factor authentication. We cover it in our round-up of the biggest scams and hacks.
• Unpatched software. Known security holes in operating systems, apps and internet-connected devices that were never updated.
• Fake fixes. A website tells you to paste a command or install a “verification” tool to prove you are human. Our ClickFix explainer shows how this one works.
• Infected downloads, such as pirated software, fake updates or cracked games.

How to prepare: the habits that matter

Ransomware recovery is mostly decided before the attack. CISA, the US cyber defence agency, publishes a detailed guide for organisations, and its advice boils down to a few habits that work for families and small businesses too.

1. Keep offline backups and test them. CISA recommends offline, encrypted backups of important data, tested regularly, because ransomware often goes after backups that are reachable from the infected computer. A backup sitting on a drive that is always plugged in can be encrypted along with everything else. Our guide to the 3-2-1 backup rule shows a simple set-up.
2. Use two-factor authentication. CISA recommends phishing-resistant multi-factor authentication for all services, especially email and remote access. See our two-factor setup walkthrough.
3. Use unique, long passwords. CISA suggests passwords of at least 15 characters, unique to each account. A password manager does the remembering for you.
4. Patch promptly. Turn on automatic updates for your operating system and apps, and update your router and any internet-facing device. Prioritise anything exposed to the internet.
5. Do not expose remote access. CISA advises against leaving services such as Remote Desktop open to the internet. If you need remote access, put it behind extra protection.
6. Limit what each account can do. Use a normal account for daily work and an administrator account only when you need it.
7. Be careful with email. Disable macros in Office files from email, and treat unexpected attachments as suspect.

If you are hit: the first hour

Stay calm and move in this order. CISA’s response checklist is written for organisations, but the first steps apply to anyone.

1. Disconnect. Unplug the network cable or turn off Wi-Fi on affected computers to stop the spread. If several devices are affected, take the whole network offline.
2. Do not switch things off unless you have to. CISA says to power devices down only if you cannot disconnect them from the network. Turning a device off can erase evidence that experts use to work out what happened.
3. Use another channel to communicate. Phone calls or a different, clean device. The attackers may be watching the compromised system.
4. Do not log in to anything from an infected device. Change passwords from a clean one, starting with email and banking.
5. Call for help. Contact an IT professional you trust. In the US, report to CISA, the FBI (through IC3.gov, the FBI’s Internet Crime Complaint Center) or the US Secret Service. Outside the US, use your national cyber agency or find the right body on our Report a Scam page.
6. Ask about decryptors before paying. CISA advises consulting federal law enforcement about possible decryptors. Free tools exist for some ransomware families.
7. Rebuild and restore. Restore from a clean, offline backup onto cleaned or rebuilt devices, then change passwords and fix the way in.

Should you pay?

This is a hard decision, and this guide cannot make it for you, but these points are worth knowing before you do:

• Paying does not guarantee you get your files back, or that the criminals delete the stolen copy. Victims have paid and still had their data leaked, as the Change Healthcare case below shows.
• Payment funds the next attack. Paying also marks you as a customer who pays.
• A good backup removes most of the pressure. If you can restore, you can usually refuse.
• In some countries, paying certain groups can break sanctions law, which is another reason to talk to law enforcement first.
• In the 2024 Change Healthcare attack, UnitedHealth confirmed it paid about US$22 million, and data on about 192.7 million people was still affected. It is a reminder that payment solves one problem, not both.

What an attack looks like, step by step

Large attacks do not happen in an instant. They usually follow a slow build-up, which is why early warnings are easy to miss. Taking the 2024 Change Healthcare attack as an example (the facts come from our round-up):

1. Getting in. On February 12, 2024, attackers logged in to a remote-access portal using stolen login details. There was no second step to stop them.
2. Time inside. For the next nine days the attackers were inside the network, and data was taken.
3. Locking. On February 21, they set off the ransomware, and systems were locked.
4. The demand. A ransom note appeared, and the group threatened to publish the stolen data.

For a family or a small business the timeline is usually shorter, but the shape is the same: an unnoticed way in, a quiet period, then the lock. The practical lesson is that the habits that close the way in (two-factor sign-in, updates, careful clicking) matter more than anything you can do once the screen has turned red.

Common myths

• “I have nothing worth stealing.” Your photos, documents and ability to run your business or household are exactly what you will pay to get back.
• “Only Windows gets it.” Windows is the most common target, but other systems, phones and servers are hit too. Do not rely on your operating system for protection.
• “I will know straight away.” Often the encryption comes days after the break-in.
• “Paying fixes everything.” Payment does not guarantee working keys, and it does nothing about stolen copies of your data.
• “My cloud folder is a backup.” Sync copies the scrambled files too. See our backup guide.

Small businesses: the short list

A small business cannot afford a week of downtime, and criminals know it. If you only have time for four things:

1. Two-factor sign-in on email and every remote-access tool.
2. An offline backup that you have actually restored from at least once.
3. Automatic updates, and a list of the devices and services you rely on.
4. A one-page plan: who to call, where the backups are, and how to contact customers without your normal email.

Our small business basics guide goes through all of these in more detail.

Sources

• CISA: #StopRansomware GuideAccessed October 12, 2026
• cyberhygiene.tools: The biggest scams and hacks of the last 3 years (Change Healthcare figures and sources)October 9, 2026

Published October 12, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.