Glossary
Ransomware
Ransomware is malware that locks your files or your whole computer and demands payment to unlock them.
What it means
Ransomware is malware that locks your files or your whole computer and demands payment to unlock them. It usually arrives through a phishing email or an unpatched program, encrypts your documents, photos and databases, and then shows a message demanding payment — most often in cryptocurrency — for the key that would unlock them. It is one of the most damaging attacks an ordinary person or a small organisation can face, precisely because it takes away the things that matter most to the victim.
How it works
The newer variant, double extortion, does not stop at locking your files: it also steals a copy first, and threatens to publish it if you do not pay. Ransomware is also sold as a service — ransomware-as-a-service — where the developers of the malware rent it out to affiliates who carry out the attacks, in exchange for a share of the payments. The attacks themselves are usually entry-level in method: a phishing email with a malicious attachment, or a known vulnerability in software that was never updated. The damage is not technical sophistication but the fact that the victim's files are the leverage.
Example
Imagine a fictional small business, Greenfield Books, whose owner opens an email that looks like an invoice from a supplier. The attachment encrypts the shop's entire customer database and order history, and a message demands payment within 72 hours — with a second threat that the customer data will be published if they refuse. The shop's backup, kept on the same computer, is encrypted too. The recovery is slow: disconnect the computer, do not pay, report the incident, and rebuild from the off-site backup that was kept separate. The lesson of the example is the backup: the one habit that turns ransomware from a disaster into a bad week is a backup kept away from the machine it protects.
Common misunderstandings
The most dangerous misunderstanding is that paying guarantees your files back. It does not: many victims pay and receive nothing, or receive a key that does not work, and paying funds further attacks. Official guidance from governments and security agencies is consistent — do not pay. The right response is to disconnect the device, restore from a backup, and report the incident to the authorities.
Related terms
Learn more
- What is ransomware?
- What is double extortion ransomware?
- Should you pay ransomware?
- Cybersecurity Awareness Path
- Back to the full glossary
Last checked: 14 November 2026.
Frequently asked questions
Should I pay a ransomware demand?
No. Official guidance is consistent: paying does not guarantee you get your files back, and it funds further attacks. Disconnect the device, restore from a backup if you have one, and report the incident to the authorities in your country.
How does ransomware usually arrive?
Most often through a phishing email with a malicious attachment or link, or through a known vulnerability in software that was never updated. It rarely arrives through a sophisticated break-in — the ordinary routes are the ones that work.
What is double extortion ransomware?
A variant that steals a copy of your data before encrypting it, then threatens to publish the stolen data if you do not pay — so the victim faces two pressures at once: locked files and exposed data.