Ransomware in plain words
A program locks your files and its authors sell you the key. What decides the outcome is what you set up before it happens.
What it is
Ransomware is malicious software that encrypts files so that they can no longer be opened, then shows a demand for payment. Many groups also copy the files first and threaten to publish them.
How it gets in
The three common routes are an attachment or link in an email, a stolen or guessed password for a remote-access service, and a known flaw in software that was never updated. This is why ordinary habits matter: careful reading of messages, a second sign-in step and prompt updates close all three.
If it happens
Disconnect the affected computer from the network and Wi-Fi at once, but leave it switched on. Tell your IT team immediately. At home, unplug any backup drive that is still attached. Do not delete anything.
CISA and the FBI advise against paying: payment does not guarantee that the files come back, and it funds the next attack. The No More Ransom project publishes free decryption tools for some ransomware families, and the incident can be reported to the police or to the national cyber security centre in your country.
What makes it survivable
A recent backup kept disconnected from the computer turns ransomware into lost hours rather than lost years. Test that you can restore from it.
This note is our own plain-language summary. For the full guidance, read the original: https://www.cisa.gov/stopransomware
Disconnect it, but leave it on.