What Is Ransomware? How Attacks Work, Who Pays and How to Protect Yourself

What is ransomware?

The US Cybersecurity and Infrastructure Security Agency (CISA) defines ransomware as malware designed to encrypt files on a device, making them and the systems that rely on them unusable, after which criminals demand a ransom in exchange for decryption ^[1]. Encryption here means scrambling files with a key that only the attacker holds. The UK National Cyber Security Centre (NCSC) notes that the computer itself may be locked, or data may be stolen, deleted or encrypted, and that some ransomware spreads to other machines on the network, as WannaCry did when it hit the NHS in May 2017 ^[3].

Victims are usually told to contact the attacker through an anonymous email address or web page and to pay in a cryptocurrency such as Bitcoin ^[2]. Microsoft notes that an infection usually does not show itself until a window, app or full-screen message demands money, often after the files are already encrypted ^[7].

What is double extortion?

Over time, attackers have also copied victims' data and threatened to publish it to pressure them to pay; using both encryption and the leak threat is known as double extortion ^[1]. In some cases criminals skip encryption altogether and use the stolen data as their only lever ^[1].

How does a ransomware attack work?

The NCSC describes a typical sequence ^[2]:

1. Attackers gain access to the network, establish control and plant malicious encryption software; they may also copy data to threaten a leak ^[2].
2. The malware is activated, locking devices and encrypting data across the network ^[2].
3. An on-screen notice explains the ransom and how to pay, usually through an anonymous web page and in cryptocurrency ^[2].

How do attackers get in?

CISA groups the most common initial access vectors as internet-facing vulnerabilities and misconfigurations, compromised credentials, phishing, earlier malware infections, advanced social engineering, and third parties or managed service providers ^[1]. The NCSC says ransomware is increasingly deployed by attackers who gain remote access through exposed services such as Remote Desktop Protocol (RDP) or unpatched remote access devices ^[3]. For home users, Microsoft lists opening unexpected attachments and malicious links in email, social media, messaging apps or SMS as common routes ^[7].

Who is behind it?

Ransomware is now run as an interconnected marketplace of access, infrastructure and payment services, according to the blockchain analysis firm Chainalysis ^[5]. Major 'ransomware-as-a-service' (RaaS) operations fragmented in 2025 into many smaller, independent actors, with some analyses tracking as many as 85 active extortion groups ^[5]. Initial access brokers (IABs) facilitate entry to compromised networks so that affiliates, the criminals who actually deploy the ransomware, can attack with relative ease; Chainalysis found spikes in IAB activity typically precede increases in ransomware payments and leaks by roughly 30 days ^[5].

How big is the ransomware problem?

The FBI's Internet Crime Complaint Center (IC3) received 3,611 ransomware complaints in 2025, up from 3,156 in 2024, with reported losses of 32,320,105 US dollars ^[4]. The FBI cautions that this loss figure does not normally include lost business, time, wages, files or equipment, or third-party remediation, that some victims report no loss at all, and that the result is an artificially low loss rate ^[4]. Its most reported variants in 2025 were Akira, Qilin, INC./Lynx/Sinobi, BianLian and Play, and the critical infrastructure sectors it hit most often included critical manufacturing, healthcare and public health, and government facilities ^[4]. The IC3 identified 63 new variants during the year ^[4].

Chainalysis estimates that ransomware actors received more than 820 million US dollars in on-chain payments in 2025, about 8% less than its updated 2024 estimate of 892 million, even though claimed victims rose 50% to the most active year on record ^[5]. It suggests the share of victims who pay may have fallen to an all-time low of 28% ^[5]. At the same time, the median payment rose 368%, from 12,738 to 59,556 US dollars ^[5]. These are estimates from blockchain tracing and may be revised as more payments are attributed ^[5].

Single incidents can be very costly. Chainalysis cites the 2025 cyberattack on Jaguar Land Rover, which halted production lines and caused an estimated 1.9 billion pounds of economic damage, the costliest cyber event in UK history ^[5].

Should you pay a ransom?

Official guidance is consistent: do not pay if you can avoid it. CISA and its partners do not recommend paying, because payment does not ensure your data is decrypted, that your systems are no longer compromised, or that your data will not be leaked ^[1]. The NCSC says UK law enforcement do not encourage, endorse or condone paying, and warns that if you pay there is no guarantee of access and you are more likely to be targeted again ^[3]. It adds that some malware only pretends to be ransomware: it is wiper malware, and files are not decrypted after payment ^[3].

What are the legal risks?

In September 2021 the US Treasury's Office of Foreign Assets Control (OFAC) updated an advisory on potential sanctions risks for facilitating ransomware payments, stressing that the US government strongly discourages paying cyber ransoms and encouraging victims to report attacks ^[10]. CISA's guide also notes that paying ransoms may pose sanctions risks ^[1].

In the UK, the government announced on 22 July 2025, after a public consultation, that it would take forward measures to ban public sector bodies and operators of critical national infrastructure, including the NHS, local councils and schools, from paying ransom demands ^[9]. Under the proposals, other businesses would have to notify the government of an intent to pay, and a mandatory reporting regime is being developed ^[9]. As of 3 November 2026, readers should check GOV.UK for whether these measures have become law.

This is general information, not legal or financial advice. An organisation facing a demand should involve law enforcement, legal counsel and an incident response provider.

How can you protect yourself from ransomware at home?

1. Back up what you value. The NCSC defines a backup as a copy of important data stored in a separate safe location, such as cloud storage or removable media, and lists malware such as ransomware among the reasons you may lose access ^[8].
2. Keep at least one backup disconnected. The NCSC advises that backup devices such as external drives and USB sticks should not be permanently connected, because attackers target connected backups ^[3].
3. Use version history. Choose a cloud service that keeps previous versions, because cloud services often synchronise straight after files are replaced with encrypted copies ^[3]. Microsoft says OneDrive includes ransomware detection and file versioning ^[7].
4. Update everything. Keep Windows and other software patched and Windows Security turned on ^[7]; the NCSC recommends automatic updates for operating systems, applications and firmware where possible ^[3].
5. Turn on Controlled Folder Access in Windows 10 or 11 to protect important folders from unauthorised programs ^[7].
6. Be careful with attachments and links you were not expecting, including in messaging apps and SMS ^[7].

How do organisations reduce ransomware risk?

The FBI's 2025 recommendations for companies include offline or off-site backups that are encrypted and immutable (cannot be altered or deleted), removing default passwords, disabling unnecessary protocols, limiting administrator rights, multi-factor authentication (MFA) for webmail, VPNs and critical systems, network segmentation, and prompt patching of internet-facing systems ^[4].

CISA advises maintaining offline, encrypted backups and regularly testing them, because most ransomware actors try to find and delete or encrypt accessible backups ^[1]. It also recommends keeping 'golden images', preconfigured system templates that can quickly rebuild servers, and not exposing services such as RDP to the internet ^[1]. The NCSC adds that organisations should plan and rehearse their response, including how to keep critical services running if systems are unavailable and how they will respond to a ransom demand ^[3]. The UK government likewise urges offline backups and tested plans to operate without IT for an extended period ^[9].

What should you do if ransomware hits?

1. Isolate affected devices. CISA says to unplug them from the network or remove them from Wi-Fi; if a whole network is affected, take it offline at the switch level ^[1].
2. Power down only if you cannot disconnect. CISA notes that powering down destroys evidence in memory, so it is a fallback ^[1].
3. Use out-of-band communication. Attackers may be watching email and chat, so CISA suggests phone calls when coordinating the response ^[1].
4. Clean the device before restoring. Microsoft advises fully cleaning the PC with security software before trying to recover files ^[7]; the NCSC says to scan backups for malware and connect them only to known clean devices ^[3].
5. Check for a free decryptor. The No More Ransom project, cited by the NCSC, offers decryption tools for some ransomware families, though not every type has a solution ^[6][3].
6. Report it. In the UK, incidents can be reported to the NCSC and to Report Fraud ^[3]; in the US, the FBI asks victims to file a report with IC3 ^[4]. Microsoft says anyone who has already paid should contact their bank and local authorities immediately ^[7].

How is Iran connected to ransomware activity?

In August 2024, the FBI, CISA and the Department of Defense Cyber Crime Center warned that a group of Iran-based cyber actors, which the FBI assesses is associated with the Government of Iran, was obtaining access to US and foreign networks and collaborating with ransomware affiliates, including NoEscape, Ransomhouse and ALPHV (BlackCat), in exchange for a percentage of ransom payments ^[12]. The advisory says the actors often gained entry by exploiting networking devices such as Citrix NetScaler and F5 BIG-IP ^[12].

In September 2022, the US Treasury sanctioned ten individuals and two entities affiliated with the Islamic Revolutionary Guard Corps for malicious cyber activity, including ransomware; it said the group activated Microsoft BitLocker on victims' networks without authorisation and held the decryption keys for ransom ^[11]. These are findings by US agencies. Sanctions designations of this kind are one reason OFAC warns that paying a ransom can carry sanctions risk ^[10].