Overview
Direct Answer
Ransomware is malicious software that encrypts or locks a victim's data, rendering it inaccessible, and demands payment in exchange for decryption or restoration. Modern variants often exfiltrate sensitive files before encryption, enabling double-extortion attacks that threaten public disclosure alongside operational disruption.
How It Works
Ransomware typically enters systems through phishing, unpatched vulnerabilities, or compromised credentials, then executes encryption algorithms against files and databases whilst evading detection. The attacker maintains exclusive possession of decryption keys and communicates ransom demands via anonymous channels, often leveraging cryptocurrency for untraceable payment.
Why It Matters
Organisations face severe operational downtime, regulatory penalties, reputational damage, and financial loss through ransom payments and recovery costs. Critical sectors including healthcare, finance, and energy infrastructure report significant disruption, making ransomware defence a board-level priority and compliance requirement under data protection frameworks.
Common Applications
Manufacturing facilities have experienced production halts; hospitals have diverted emergency patients; local government services have suspended citizen-facing operations. Financial institutions, law enforcement, and supply chain operators all report high-impact incidents affecting service continuity and data integrity.
Key Considerations
Paying ransoms does not guarantee decryption key delivery and may fund further criminal activity; moreover, some jurisdictions restrict ransom payments through sanctions enforcement. Organisations must balance immediate recovery pressure against long-term strategic defences including air-gapped backups, segmentation, and threat intelligence.
More in Cybersecurity
Encryption
Data ProtectionThe process of converting plaintext data into ciphertext using an algorithm, making it unreadable without the decryption key.
Security Operations Centre
Defensive SecurityA centralised facility where security professionals monitor, detect, analyse, and respond to cybersecurity incidents.
Threat Modelling
Security GovernanceA structured approach for identifying, quantifying, and addressing security threats to a system or application.
AI Security
Offensive SecurityThe discipline of protecting AI systems from adversarial attacks, data poisoning, model theft, and prompt injection while ensuring the secure deployment of AI in production environments.
Man-in-the-Middle Attack
Offensive SecurityAn attack where the attacker secretly relays and potentially alters communication between two parties.
Software Supply Chain Security
Security GovernancePractices and tools that protect the integrity of software components, dependencies, build pipelines, and distribution channels from compromise and tampering.
Secrets Management
Identity & AccessThe secure storage, distribution, rotation, and auditing of sensitive credentials such as API keys, tokens, passwords, and certificates used by applications and services.
Extended Detection and Response
Offensive SecurityA unified security platform that integrates multiple security tools and data sources for comprehensive threat detection.