Ransomware has evolved from a nuisance into a multi-billion-dollar criminal industry. Here's what you need to know to protect yourself — and what to do if you're hit.
Ransomware is malware that encrypts your files and demands payment — typically in cryptocurrency — for the decryption key. What began as a relatively crude criminal scheme in the late 2000s has evolved into a sophisticated, multi-billion-dollar industry with professional customer service, negotiation teams, and affiliate programs. The FBI's Internet Crime Complaint Center received over 2,825 ransomware complaints in 2024 alone, with adjusted losses exceeding $59 million — and those are only the reported cases. The actual numbers are substantially higher.
How ransomware reaches you: the most common delivery vectors are phishing emails with malicious attachments or links, drive-by downloads from compromised websites, exploitation of unpatched software vulnerabilities, and — increasingly for businesses — compromised Remote Desktop Protocol (RDP) credentials. For home users, phishing is by far the most common entry point. A convincing email that appears to be from FedEx, your bank, or a government agency, containing a document that 'requires your signature,' is the classic delivery mechanism. The document contains a macro or exploit that installs the ransomware when opened.
Prevention layer 1 — backups: the single most important ransomware protection is a backup strategy that ransomware cannot reach. The 3-2-1 rule: three copies of your data, on two different media types, with one copy offsite. For home users, this means: your primary files on your computer, a local backup on an external drive (disconnected when not in use — ransomware will encrypt connected drives), and a cloud backup (Backblaze, iDrive, or similar). Cloud backups with versioning are particularly valuable because they let you restore files from before the encryption occurred, even if the ransomware deleted local backups.
Prevention layer 2 — security software with ransomware-specific protection: most major security suites now include dedicated ransomware protection modules that monitor for the behavioral signatures of ransomware (rapid file encryption, shadow copy deletion, backup interference). Bitdefender's Anti-Ransomware module, Malwarebytes' ransomware rollback feature, and Kaspersky's System Watcher all use behavioral detection to catch ransomware before it completes encryption. Windows 10 and 11 include 'Controlled Folder Access' in Windows Security, which prevents unauthorized programs from modifying files in protected folders — enable it.
Prevention layer 3 — patching and email hygiene: keep your operating system and all software updated. Ransomware operators actively exploit known vulnerabilities in unpatched software — the WannaCry attack that infected 200,000 computers in 150 countries in 2017 exploited a Windows vulnerability that Microsoft had patched two months earlier. Enable automatic updates. For email, be deeply skeptical of any attachment you weren't expecting, any link that asks you to log in, and any message that creates urgency ('Your account will be suspended in 24 hours'). When in doubt, navigate directly to the website rather than clicking the link.
If you're hit: disconnect from the network immediately to prevent spread to other devices. Do not pay the ransom — payment does not guarantee decryption, funds criminal operations, and marks you as a willing payer for future attacks. Check NoMoreRansom.org, a collaboration between law enforcement and security vendors that provides free decryption tools for many ransomware families. If you have backups, restore from them after completely wiping and reinstalling your operating system. Report the attack to the FBI's Internet Crime Complaint Center (IC3.gov) — your report contributes to law enforcement investigations even if individual recovery isn't possible.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.