Few cyber-threats are as frightening as ransomware: you turn on your computer to find every file locked and a demand for payment to get them back. It hits individuals, hospitals and big companies alike. Understanding how it works is the first step to avoiding it. Our GetMyPassword team explains what ransomware is, how it gets in, what to do if you are hit, and how to keep it from happening.
What ransomware is
Ransomware is a type of malware that encrypts your files — documents, photos, everything — and then demands a ransom, usually in cryptocurrency, for the key to unlock them. Some variants also threaten to leak your data if you do not pay. It turns your own files into hostages.
How it gets in
- Phishing emails with malicious attachments or links — the most common route.
- Fake downloads and pirated software hiding the payload.
- Weak or reused passwords on remote-access tools that let attackers in directly.
If you are hit
Disconnect the device from the network to stop it spreading. Do not rush to pay — payment does not guarantee recovery and funds further crime; check resources like No More Ransom for a free decryptor first. The clean fix is to wipe the device and restore from a backup, which is why having one matters so much. Report the incident to the authorities.
A recent backup turns ransomware from a catastrophe into an inconvenience. If your files exist safely somewhere else, you can wipe and restore instead of paying a criminal and hoping.
How to prevent it
Keep regular backups (ideally one offline or in the cloud), update your system and apps, and be cautious with email attachments and downloads. Because attackers often get in through weak logins, give every account a unique password from our password generator and enable two-factor authentication — especially on any remote-access or admin account. Strong access control closes one of ransomware’s favourite doors.
Frequently asked questions
Should I pay the ransomware ransom?
Authorities advise against it. Paying does not guarantee you get your files back, marks you as a willing target, and funds more attacks. Try a free decryptor and restore from backup first, and report the incident.
Can ransomware be removed?
The malware can be removed with security tools, but that does not decrypt files already locked. The reliable recovery is to wipe the device and restore from a clean backup, which is why backups are essential.
How do I protect myself from ransomware?
Keep regular backups, update software, avoid suspicious attachments and downloads, and secure logins with unique passwords and two-factor authentication. These steps block the most common ways ransomware spreads.