A ransomware incident can turn ordinary files and services into a sudden obstacle to daily life or work. For people in the United States, that may mean losing access to family photos, tax records, or personal accounts. For a business, the effects can reach customer data, staff tools, and essential services.
Both individuals and organizations need a plan for protecting information and making sound choices during a stressful event. The steps ahead explain how these attacks affect devices, how to lower the risks, and how to prepare for recovery. Good preparation can help limit disruption, even though no safeguard can promise that an attack will never happen.
Key Takeaways
- Ransomware can block access to personal files and business services.
- Layered security helps reduce risk and spot suspicious activity sooner.
- Separate, tested backups give you another way to restore files.
- Organizations should assign response roles before an incident begins.
- During an attack, quick containment can help protect other systems.
- Knowing a few practical steps before an incident can make it easier to protect important information and make sound decisions under pressure.
What Happens During a Ransomware Attack?
A ransomware attack usually begins with unauthorized access and can end with files or systems unavailable to their users. Ransomware is malware designed to encrypt files on a device, which can make those files and related systems unusable. The statement that ransomware can take control of systems and data on a network is broadly true, but the impact depends on what attackers can reach.
An attack does not follow one fixed path. Attackers may gain a foothold, expand their access, collect data, and send it outside the network. That movement may involve several devices, servers, and accounts.
From initial access to data theft
After gaining access, attackers may look for valuable files and credentials. They may seek systems that hold customer records, work files, or backup copies. Their next actions depend on the access they have and the defenses they meet.
Lateral movement means an attacker’s movement from one compromised system to other systems on the same network. This can widen the incident beyond the device that first showed a problem. It may also give attackers access to data held elsewhere.
Ransomware can disrupt more than one device when attackers reach connected systems. The actual damage depends on the access they gain.
Encryption, lockout, and extortion
When encryption begins, users may find that files will not open or that business systems no longer work. Attackers can then demand payment in exchange for a promised decryption key. Some also threaten to expose data they have stolen.
A CISA definition of ransomware describes malware that encrypts device files and makes them unusable until attackers demand ransom. Not every incident follows the same sequence, and some attacks focus on data theft or lockout instead. Treating unusual activity as a possible early stage gives defenders a chance to limit further access.
How Does Ransomware Get Into a Network?
Phishing is one of the common ways attackers get an initial foothold, alongside software flaws and compromised remote access. There is no single route in every case, but phishing is a common top way ransomware infections start. A specific organization may face its main risk from exposed services or stolen credentials instead.
A malicious email link or attachment can lead a user to a fake sign-in page or harmful download. If a user opens a risky file, malware may run on the device. Attackers can also exploit an unpatched vulnerability, which is a flaw in software that has not been fixed.
Phishing and malicious downloads
Phishing messages often try to make a user act before checking the request. A link may lead to a page that steals a password, while an attachment may carry malware. A compromised account can give attackers access without a new infection from email.
Malicious downloads can also come from unsafe websites or files that appear useful. When software has a known flaw, attackers may use it to gain access without tricking a user. The risk rises when systems remain exposed and unpatched.
Exposed remote access and software flaws
Remote access tools let approved users connect to a device from another place. The remote desktop protocol, or RDP, is one way to reach a computer remotely. If attackers steal or guess valid login credentials, they may use RDP to enter.
Phishing, vulnerability exploitation, and compromised remote access are common ways attackers gain initial access. The table compares those routes and a defense that can reduce each risk.
| Entry route | How it works | Relevant defense |
|---|---|---|
| Phishing | Malicious link or attachment | Message filtering and staff checks |
| Vulnerability exploitation | Unpatched software flaw | Timely software updates |
| Compromised remote access | Stolen or guessed login credentials | Multifactor authentication and access limits |
Keep an inventory of internet-facing services so exposed entry points do not go unnoticed. A service that no one uses can still offer an attacker a way in.
What Types of Ransomware Attacks Should You Know?
Some attacks encrypt files, while others block a device or threaten to expose information that has been stolen. The ransom note may describe different kinds of pressure, so the threat is not always limited to file recovery. Double extortion means attackers combine data theft with encryption, rather than using a separate kind of file encryption.
Encrypting ransomware changes files so users cannot open them without a decryption key. Screen-locking ransomware blocks access to a device or its operating system. Both forms can disrupt work, but they affect access in different ways.
Encrypting and screen-locking attacks
With encrypting ransomware, attackers may demand payment for a key they claim will restore access. That promise does not mean the key will work or that every file can be recovered. A locked screen may prevent a user from reaching the device, even when files remain unchanged.
These attack forms can appear together with other threats. An attacker may lock a device while also trying to reach other systems. The details in a ransom note do not reveal the full extent of an incident.
Double extortion and data theft without encryption
Double extortion adds pressure by threatening to publish or sell stolen data as well as encrypting files. Data theft without encryption follows a different pattern: attackers copy information but leave files usable. They may still demand payment to keep the stolen information private.
The table separates what each form does from the pressure tactic used. One incident can include more than one form, so a clear ransom note does not rule out other threats.
| Attack form | Effect on files or device | Attacker’s pressure tactic |
|---|---|---|
| Encrypting ransomware | Encrypts files | Demands payment for a promised decryption key |
| Screen-locking ransomware | Blocks device or operating system access | Demands payment to restore access |
| Double extortion | Steals data and encrypts files | Threatens both continued lockout and data release |
| Data theft without encryption | Copies data while files may remain usable | Threatens to publish or sell stolen information |
A threat to publish stolen information can remain even when a victim has clean copies of their files. The copied data may still require careful handling after systems return.
What Can a Ransomware Attack Disrupt?
A ransomware incident can interrupt work long before anyone knows how much data is affected. Lost access can spread through daily operations when staff rely on shared records, servers, or business software. Restoring systems and services can take weeks in some cases, even when recovery is possible.
People may be unable to view records, take orders, contact customers, or provide care. Work may shift to paper or stop while teams check which devices remain safe. Data exposure can create a separate concern for customers and staff.
The WannaCry malware affected NHS services in May 2017, showing how a malware event can disrupt health care. That incident remains a historical example of the risk to essential services. A similar loss of access can affect a business, a public agency, or a household.
Recovery takes more than replacing locked files. Teams may need to rebuild systems, check data, restore services, and review what attackers reached. Long delays can also weaken customer trust, especially when people cannot get clear updates.
CISA’s account of the Colonial Pipeline attack discusses ransomware’s effect on critical infrastructure and later security efforts. Its archived post describes lessons from the 2021 attack. Identify which services must return first so disruption does not leave essential work without a clear priority.
What Do the 2025 Ransomware Figures Show?
IC3 recorded 3,611 ransomware complaints and $32,320,105 in reported losses in 2025. Those figures count reports, not every incident that happened. IC3 received 1,008,597 complaints across all crime types and reported $20.877 billion in total losses that year.
Ransomware complaints were one part of that broader total. IC3 also recorded 191,561 phishing and spoofing complaints in 2025. These counts can help show the scale of reported crime, but complaint numbers do not measure every attack.
The 2025 IC3 Annual Report records complaints and losses across many crime types. A complaint can describe one reported event, while other incidents may never reach the agency. The figures should not be read as a full count of crime in the United States.
SafePay offers a current example of the threat to organizations. By October 20, 2026, CISA said SafePay had affected at least 600 victims across multiple critical infrastructure sectors. CISA also reported that the group had been highly active since August 2024.
SafePay was among the most active ransomware groups in 2026, according to CISA. The example shows why organizations in different sectors need to plan for disruption. Treat complaint and loss figures as reported incidents, not a complete count of every attack.
What Is Ransomware and How Can You Prevent It?
No single safeguard prevents every ransomware attack, so the strongest approach combines several defensive layers. Ransomware is malware that can block access to files or devices and demand payment. The best way to avoid infections is to combine prevention, detection, containment, and recovery, not rely on one tool.
This approach is called defense in depth. Each layer helps when another control misses a threat. Individuals can focus on devices and accounts, while organizations must also protect networks, staff, and services.
Reduce the chance of an initial infection
Start by lowering the number of ways an attacker can reach your systems. This includes keeping software current, protecting accounts, and limiting exposed services. Good security solutions work together rather than compete as one magic fix.
Organizations can use CISA’s #StopRansomware Guide to shape a broader defense plan. It covers steps for reducing risk and preparing for incidents. A small business can assign someone to track controls and overdue fixes.
Detect suspicious activity early
Detection gives you a chance to act before an incident reaches more systems. Watch for unusual logins, unexpected file changes, and alerts from security tools. A clear reporting path helps staff flag concerns without waiting for proof.
Individuals can pay attention to sudden changes on personal devices. Organizations should know who reviews alerts and who can make containment decisions. Early notice matters because attackers may seek wider access after entry.
Limit damage and prepare to recover
Containment limits the number of systems an attacker can reach. Recovery planning gives people a way to restore essential work if files become unavailable. Those steps should fit the size and needs of your home or organization.
- Reduce initial access by strengthening common entry points.
- Detect suspicious activity through alerts and clear reporting.
- Prepare to contain an incident and recover key services.
Review the layers together, since a weakness in one can make the others more important. A written list can help you see whether one defense depends too heavily on another.
How Can You Secure Remote Access?
A stolen or guessed password can be enough to expose a remote login when that account lacks stronger safeguards. Remote access needs more than a password, especially when the service can reach important systems. Disable RDP if you do not need it, and restrict it when you do.
The remote desktop protocol, or RDP, lets a user control a computer from another place. VPNs also allow remote connections, but poor settings can leave access open too widely. Limit remote access to people and devices that need it.
Reduce exposure from RDP and other services
Check which remote services can be reached from the internet. Remove public access where it is not needed, and limit approved connections to known users. Review VPN settings so remote access does not grant more reach than a task requires.
Multifactor authentication, or MFA, adds a check beyond a password. It can make a stolen password less useful, but it does not replace patching or access limits. CISA advises organizations to use MFA and strong identity, credential, and access management.
Strengthen remote accounts and edge devices
Use strong, unique credentials for remote accounts and remove access when a person no longer needs it. Edge devices, such as firewalls, sit between a network and outside connections. A flaw in one can provide a path into the network.
CISA advises prompt updates for firewalls and other edge devices. By October 20, 2026, CISA said SafePay actors typically gained access through stolen or guessed passwords, exploited vulnerabilities, and phishing. Check remote login exposure and edge-device updates together, since both can provide a path into the network.
How Do Backups Help You Restore Files?
An offline, encrypted copy gives you a recovery option that an attacker cannot reach through an ordinary live connection. Backups can reduce data loss when ransomware encrypts files or disrupts systems. Keep at least one copy separate from the network and test whether you can restore it.
Attackers may search for accessible backups and delete or encrypt them. A copy that stays connected to the same network may be exposed during an attack. Multiple copies in different places can offer more recovery choices.
Keep recovery copies separate
An external drive can be disconnected when it is not in use. An isolated cloud backup may keep older versions that help after files change. A network-connected backup can be easy to reach during normal work, but that same access can expose it.
Compare external drives by capacity, portability, speed, and computer connections before choosing one. This external hard drive guide explains common choices for backup use. Keep another copy apart from the main device or network.
| Backup arrangement | How it supports recovery | Main limitation |
|---|---|---|
| Offline external copy | Can restore files without a live network link | Needs safe storage and manual updates |
| Isolated cloud backup with version history | May offer older file versions from a separate service | Restore depends on account access and service availability |
| Network-connected backup | Can support quick access during routine work | May be reachable by attackers on the network |
Test restoration before an emergency
A backup is useful only if its files open and the restore process works. Test recovery on a clean device or in a safe test setting. Check the data before returning it to a system that may still be at risk.
- Separate a copy from the network.
- Encrypt the backup copy.
- Test file restoration on a clean device.
- Verify files are clean before use.
Test a restore before an emergency, because a backup is useful only if its files can be recovered. Record the steps that worked so others can repeat them.
How Can Staff Spot Phishing Attempts?
A message can look ordinary and still be designed to make a user open a malicious link or attachment. Pause when a request feels unusual, especially if it urges quick action or asks for account details. Verify surprising requests through a trusted channel before replying, clicking, or opening a file.
Check the sender’s full address, not just the display name. Look for links that do not match the company or service named in the message. An unexpected attachment deserves extra care, even when the email seems to come from someone you know.
Attackers may use a familiar logo or a current work topic to make a message feel routine. Urgent language can push a user to skip normal checks. A link may steal a password, while an attachment can deliver malware.
Email filtering can block malicious messages or remove executable attachments before they reach users. Filters do not catch every threat, so staff training still matters. CISA’s phishing training guidance advises regular practice and a clear way to report suspicious messages.
For organizations, make reporting easy and tell staff what happens after they flag a message. A quick report can help security teams warn others about the same campaign. Verify a surprising request through a known contact method before opening its attachment or sharing account information.
How Can You Limit an Attack Across a Network?
An attacker with one compromised account should not automatically gain access across an entire organization. Least privilege limits that reach by giving each person only the access needed for their work. Use network segmentation to keep an intrusion from moving freely between systems.
Segmentation divides a network into smaller areas with controlled links between them. A user account in one area may not need access to servers in another. This can limit lateral movement if attackers gain a foothold.
Restrict administrative tools to people who need them. Remove unused accounts and review permissions when staff change roles. An Active Directory account review can reveal former staff accounts or access that no longer fits a person’s duties.
Separate high-risk or obsolete systems from the parts of the network that handle daily work. Older devices may not support current security controls, so they should not have broad access. Limit the paths they can use to reach other systems.
Zero Trust means verifying each access request instead of trusting a user or device just because it is already inside the network. CISA advises organizations to apply this idea and restrict administrative privileges. Review permissions after staff roles change so old access does not become an overlooked route through the network.
What Should You Do First During a Ransomware Attack?
If a device may be infected, isolate it from the network immediately to limit further spread. Containment comes first, but preserve useful evidence while taking safe steps. Disconnect the affected system from Wi-Fi or its network cable if you cannot isolate it another way.
If several systems or network areas appear affected, a wider shutdown may be needed. CISA advises taking the network offline at the switch level when feasible. Ask the incident response team for help if you are unsure which devices or network areas are affected.
Isolate affected devices and network areas
Choose the smallest safe action that stops the suspected spread. A single device may need to lose its network connection, while several affected areas may call for a broader shutdown. The table outlines options and cautions.
| Action | When to use it | Key caution |
|---|---|---|
| Isolate one affected system | One device shows signs of infection | Keep notes about the device and time |
| Take network offline at switch level | Several systems or subnets appear affected | Use when feasible to limit wider spread |
| Disconnect Wi-Fi or network cables | A device cannot be isolated another way | Do not reconnect it before review |
| Power down only if disconnection is not possible | Network disconnection or shutdown cannot work | Shutdown can destroy volatile evidence |
Preserve evidence while containing the incident
Do not connect backup media to a device that may be infected. Save the ransom note, alert details, and a record of actions already taken. These details can help responders understand the incident.
- Isolate the affected device or network area.
- Avoid connecting backup media to affected systems.
- Preserve incident details for the response team.
Powering down can destroy volatile evidence, which exists only while a system remains on. Power down only when network disconnection or temporary network shutdown is not possible.
How Do You Recover Systems and Data?
Recovery should start from a clean environment, not from a device that may still be compromised. Keep affected systems contained while you identify safe devices and check backup data. Restore only after verifying that the files and systems are clean.
Confirm that the intrusion has stopped before rebuilding systems. Remove compromised software or rebuild affected devices from a known clean state. A rushed restore can bring harmful code back into service.
Rebuild from a clean environment
Start with systems that responders have checked and cleared for use. Reinstall software from trusted sources rather than relying on files from a compromised device. Keep a record of systems rebuilt and the steps used.
The No More Ransom Project offers decryption tools and other resources that may help with some ransomware infections. A tool may not work for every variant, so do not treat it as a guaranteed fix. Check backup integrity before using a copy.
Restore only verified files
Prioritize data based on the services people need first. Check restored files for signs of malware before opening them on a clean system. Then watch systems closely for unusual activity as staff return to work.
- Confirm containment and identify clean systems.
- Rebuild compromised devices and software.
- Verify backup data before restoring it.
- Restore priority data, then monitor systems.
Restore only verified files and keep monitoring systems for signs that the intrusion has returned. A staged return to service can make new problems easier to spot.
Should You Pay a Ransom?
Paying a ransom is not a reliable way to recover data, and the U.S. government does not encourage payment to criminal actors. Payment is no guarantee that attackers will provide a working decryption key. It also cannot undo data theft or ensure that stolen information will be deleted.
Attackers may keep the money and leave files locked. They may provide a key that restores only some data, or they may demand more money later. A payment does not restore trust in systems that remain compromised.
Organizations should involve legal counsel, the incident response team, and law enforcement before making a decision. Those contacts can help assess business needs, legal duties, and recovery options. A payment may also raise concerns about who receives the funds.
A promise to keep stolen data private is difficult to enforce. Attackers can copy or release information even after receiving money. Do not treat a promised decryption key or promise of secrecy as a guaranteed outcome.
Where Should You Report a Ransomware Attack?
U.S. organizations can report ransomware incidents to federal agencies and local field offices. Choose the right contacts for your situation, and do not assume one report meets every duty. Available channels include CISA, a local FBI field office, the FBI Internet Crime Complaint Center, and a local U.S. Secret Service field office.
The FBI Internet Crime Complaint Center is known as IC3. Organizations can report the incident to IC3 and contact CISA for cyber incident support. A local FBI field office or Secret Service field office is another reporting option.
Keep records of the affected systems, the time the incident began, and actions taken. Preserve relevant messages and alerts when possible. Clear details can help agencies understand what happened.
Organizations should also follow any reporting duties that apply to them. A report to one agency does not replace another required notice. Keep a record of when the incident began and which systems appear affected to support a clear report.
How Can an Organization Prepare for Recovery?
A usable incident plan gives people responsibilities before a disruption makes ordinary communication difficult. Preparation helps teams make decisions faster when services or systems are unavailable. Name who leads response work and which services must return first.
Start with an inventory of important devices, software, accounts, and services. Decide which operations can pause and which need a faster return. Include IT, legal, and leadership in the planning process.
Set out how the team will contact employees, customers, suppliers, and public agencies. Keep contact details available outside the systems that might be affected. A simple plan should say who can approve key decisions.
CISA offers cyber hygiene scanning services and tabletop exercise packages for organizations. A tabletop exercise lets staff talk through a simulated incident without disrupting live systems. It can show whether roles, contact details, and recovery priorities work in practice.
- Identify critical assets and services.
- Assign response roles across IT, legal, and leadership.
- Prepare contact information outside core systems.
- Rehearse recovery priorities with the response team.
Rehearse the plan with the people who would have to restore essential services. Update responsibilities when staff or key systems change.
How Can You Protect Home Devices?
A home device can hold valuable files and account access even when it is not connected to a company network. Personal devices need routine care, from computers to phones and tablets. Use built-in security features and install updates for your device and everyday apps.
Windows, macOS, iOS, and Android each provide built-in security and update settings. Turn on the protections that come with your device, and install apps from trusted stores. Avoid giving administrator access to every person who uses a shared computer.
Your home router also has a management account that controls its settings. Use a strong password for that account, and avoid leaving the default login unchanged. Keep the router’s software current when updates are available.
Households can make a short check part of regular device care. Review each phone, tablet, computer, and router rather than focusing on one device. That can reveal an older device that still holds personal data.
- Check device updates.
- Review installed apps.
- Use a standard account for everyday tasks.
- Secure router administration.
Review the household’s devices and router settings together so an overlooked device does not remain exposed. Include shared devices that family members use only occasionally.
Conclusion
Ransomware risk is easier to manage when prevention and recovery are planned together. Layered security can lower the chance of an incident, while a tested recovery plan can limit its effects. No safeguard can promise a perfect defense, so preparation matters for both households and organizations.
Choose one important account or system and check its protections today. Make sure the people who rely on it know how to regain access if normal work stops. Choose one critical account or system today and check that its access protections and recovery plan are current.
FAQ
How to protect yourself from a ransomware attack?
Use several safeguards together: keep software current, protect accounts, and maintain a tested backup that is offline or isolated. Built-in security tools and careful app choices can help protect personal devices. Organizations also need to limit access and plan how to contain an incident. No single tool can block every threat, so review the whole setup regularly.
Should I pay the ransom?
The U.S. government does not encourage paying a ransom, and payment does not guarantee restored data. Attackers may fail to provide a working key or may demand more money later. A payment also cannot ensure that stolen data will stay private. Organizations should speak with legal, incident-response, and law-enforcement contacts before deciding what to do.
Which of the following best describes a ransomware attack?
A ransomware attack is malware that can encrypt files or lock a device and demand payment. Some attackers also steal data and threaten to expose it, whether or not they encrypt files. The affected systems may include more than the device that first showed a problem. The exact impact depends on which accounts and systems attackers can reach.
What is ransom?
Ransom is money or another demanded payment sought in exchange for a promised action. In a ransomware incident, attackers may offer a decryption key or promise not to publish stolen information. Those promises are not guaranteed. A demand can also include a deadline or threat meant to pressure a person or organization into paying.
What happens if you get ransomware?
Ransomware may block your files or device, steal data, and put connected systems at risk. You may see a ransom note or find that files suddenly will not open. The first priority is to limit network access from affected devices. A response team can help assess the incident and decide what must happen next.
How can you tell if a computer may have ransomware?
Unexpected file changes, a ransom note, or suddenly inaccessible files can signal ransomware. A computer may also behave in unusual ways, but one odd error alone does not prove an infection. Disconnect a suspected device from Wi-Fi or its network cable, then seek incident-response help. Avoid connecting backup media until the device has been checked.
Can ransomware spread to other devices?
Yes, ransomware can reach other devices when attackers or malware can access connected systems. The spread may involve shared accounts, network paths, or weak points in other devices. Isolate a suspected device quickly to reduce that risk. Organizations can also limit how far an attacker can move by controlling access between network areas.
