Overview
Direct Answer
Ransomware is malicious software that encrypts or locks a victim's data, rendering it inaccessible, and demands payment in exchange for decryption or restoration. Modern variants often exfiltrate sensitive files before encryption, enabling double-extortion attacks that threaten public disclosure alongside operational disruption.
How It Works
Ransomware typically enters systems through phishing, unpatched vulnerabilities, or compromised credentials, then executes encryption algorithms against files and databases whilst evading detection. The attacker maintains exclusive possession of decryption keys and communicates ransom demands via anonymous channels, often leveraging cryptocurrency for untraceable payment.
Why It Matters
Organisations face severe operational downtime, regulatory penalties, reputational damage, and financial loss through ransom payments and recovery costs. Critical sectors including healthcare, finance, and energy infrastructure report significant disruption, making ransomware defence a board-level priority and compliance requirement under data protection frameworks.
Common Applications
Manufacturing facilities have experienced production halts; hospitals have diverted emergency patients; local government services have suspended citizen-facing operations. Financial institutions, law enforcement, and supply chain operators all report high-impact incidents affecting service continuity and data integrity.
Key Considerations
Paying ransoms does not guarantee decryption key delivery and may fund further criminal activity; moreover, some jurisdictions restrict ransom payments through sanctions enforcement. Organisations must balance immediate recovery pressure against long-term strategic defences including air-gapped backups, segmentation, and threat intelligence.
More in Cybersecurity
Buffer Overflow
Offensive SecurityA programming error where data written to a buffer exceeds its capacity, potentially allowing code execution.
Firewall
Network SecurityA network security device that monitors and filters incoming and outgoing network traffic based on security rules.
Security Operations Centre
Defensive SecurityA centralised facility where security professionals monitor, detect, analyse, and respond to cybersecurity incidents.
SQL Injection
Offensive SecurityA code injection technique that exploits vulnerabilities in database-driven applications through malicious SQL statements.
Software Supply Chain Security
Security GovernancePractices and tools that protect the integrity of software components, dependencies, build pipelines, and distribution channels from compromise and tampering.
AI-Powered Threat Detection
Offensive SecuritySecurity systems that leverage machine learning and behavioural analytics to identify sophisticated cyber threats, anomalous patterns, and zero-day attacks in real time.
Cyber Insurance
Security GovernanceInsurance coverage protecting organisations against financial losses from cyberattacks, data breaches, and related incidents.
Security by Design
Security GovernanceAn approach that integrates security considerations into every stage of the software development lifecycle.