What is ransomware — and how to protect your files from it

Ransomware is malware that tries to deny you access to your own data, usually by encrypting it with a key only the attacker has, and then demands a ransom to give it back. Many groups now add a second threat: they copy your data before encrypting it and threaten to publish it unless you pay — so-called double extortion.

How ransomware gets in

• Opening an email attachment, clicking an ad or a link, or visiting a website that hides malware, the FBI's IC3 says.
• Software that hasn't been updated: if your network or software is vulnerable, an attacker can slip in and plant malicious code, NIST notes.
• Exposed and poorly secured remote-access services — a common way in, according to the joint #StopRansomware Guide from CISA, the FBI and partners.
• An earlier infection. Many ransomware attacks follow other malware already on the system.

Once it's running, ransomware can spread to other computers and storage devices on the same network. And it isn't only a big-company problem: "Don't assume your business is too small to get hit," NIST warns.

How common is it?

In the US, the FBI's IC3 (its internet crime complaint service) in 2025 received 3,611 ransomware complaints reporting losses of more than $32 million. The IC3 stresses that its figures understate the real cost: they leave out lost business, time and recovery work, and many victims don't report a loss amount at all.

How to protect your files

• Keep backups that ransomware can't reach. Follow the 3-2-1 rule — three copies, in at least two places, with at least one offline — and keep backups disconnected from the computers they protect. Attackers look for and encrypt or delete any backup they can reach, and the FBI warns that cloud backups that sync continuously can be locked too.
• Keep your operating system and apps updated, with automatic updates on.
• Turn on multi-factor authentication wherever you can, especially for email.
• Be careful with attachments and links you weren't expecting.
• On Windows, turn on Controlled folder access (Windows Security > Virus & threat protection > Ransomware protection) to stop unauthorised programs from changing files in your important folders.

If you're hit by ransomware

1. Disconnect the device: unplug the network cable or turn off Wi-Fi to stop it spreading. Only power it down if you can't disconnect it — shutting down wipes evidence held in memory.
2. Don't count on paying. "The FBI does not support paying a ransom," and some victims who paid never received a decryption key. Paying also doesn't stop stolen data from being leaked.
3. If you've lost money or think you've been scammed, report it to Report Fraud at reportfraud.police.uk (England, Wales and Northern Ireland) or to Police Scotland on 101. Note the ransomware's name, the extension added to your files and the amount demanded.
4. Ask whether a free decryption tool exists. Security researchers have found flaws in some ransomware and released tools — law enforcement can tell you.
5. Clean the computer before you restore anything, then restore your files from a backup made before the infection.
6. Change your passwords from a clean device.

Does antivirus stop ransomware?

Real-time protection blocks a lot of known ransomware before it runs, and Windows' Controlled folder access adds a second lock on your most important folders. Some suites add their own tools: every TotalAV plan includes ransomware protection, and Norton's plans include Cloud Backup on Windows. But no security software catches everything. An offline backup is the only thing that reliably lets you undo an attack.

The ransom only works if the encrypted copy is your only copy. Keep one backup unplugged, and ransomware loses most of its leverage.