Ransomware: What It Is, How to Avoid It, and What to Do If Infected

Ransomware is malicious software that encrypts all the files on your computer and demands a payment (usually in cryptocurrency) to provide the decryption key. It's one of the most damaging forms of cybercrime affecting both individuals and businesses.

How ransomware gets onto your computer

• Clicking a malicious link in a phishing email
• Opening a malicious email attachment
• Downloading software from untrustworthy sources
• Visiting compromised websites
• Through remote desktop vulnerabilities in businesses

What happens when ransomware strikes

Your files (documents, photos, videos) suddenly become inaccessible and show unusual file extensions. A message appears explaining that your files have been encrypted and demanding payment within a timeframe, after which the price increases or the key is deleted.

How to protect yourself

• Regular offline backups — the single best protection. If your files are backed up to an external drive that isn't connected to your computer, ransomware can't encrypt those backups.
• Keep Windows and software updated to patch vulnerabilities
• Don't click links in unexpected emails
• Use reputable antivirus software
• Be very cautious about email attachments

What to do if infected

Immediately disconnect from the internet and any network drives. Do not try to open your files or restart the computer. Contact a professional immediately. In some cases, free decryption tools are available for specific ransomware strains — check nomoreransom.org before assuming all is lost.