Daily Junction.mobi portalTechnology · June 12, 2025 · Amelia Hart · 6 min
Ransomware locks your files and demands payment to release them. Here is how an infection actually happens, why a tested backup is your best defence, and exactly what to do if you are hit.
Imagine switching on your computer to find every file — photos, documents, work, everything — scrambled into unreadable nonsense, with a message demanding money to get them back. That is ransomware, and it has become one of the most damaging and lucrative forms of cybercrime, hitting individuals, hospitals, schools and large companies alike. Understanding how it works is the first step to making sure it never happens to you.
Ransomware is malicious software that encrypts your files so you can no longer open them, then demands a payment — usually in cryptocurrency — in return for the key to unlock them. The name is literal: it holds your data to ransom.
It is a specific, especially nasty member of the wider malware family. What sets it apart is its business model. Most malware tries to stay hidden; ransomware wants you to know it is there, because the whole scheme depends on frightening you into paying. Many modern strains go further with "double extortion" — they steal a copy of your data first, then threaten to publish it unless you pay, so even a good backup does not remove all the pressure.
The result is a threat that attacks two parts of the CIA triad at once: it destroys the availability of your files, and with data-leak threats, your confidentiality too.
Ransomware rarely breaks in through some Hollywood-style hacking. Far more often, it walks through a door someone accidentally opens. The common routes in are:
Once it is in, ransomware typically works fast and quietly: it scans for valuable files, encrypts them in the background, and often tries to reach connected drives and network shares so it can spread. Only when the damage is done does it reveal itself with a ransom note.
The uncomfortable truth is that most ransomware needs a little human help to get started — a click, a download, an ignored update. That is also the good news: the same habits that block it are simple and entirely within your control.
If there is one lesson from years of ransomware attacks, it is this: a good backup is the most powerful defence there is. If your files are safely copied somewhere the ransomware cannot reach, an attack changes from a catastrophe into a clean-up job. You wipe the infected device and restore your data — no ransom required.
But not just any backup will do. Ransomware actively hunts for connected backups to encrypt them too, so the details matter. Security experts recommend a simple rule of thumb often called 3-2-1:
| Element | What it means |
|---|---|
| 3 copies | Keep at least three copies of important data (the original plus two backups) |
| 2 media | Store them on at least two different types of media or location |
| 1 offline/off-site | Keep at least one copy disconnected or off-site, beyond the reach of an attack |
That last point is the crucial one. A backup drive left permanently plugged in can be encrypted along with everything else. An external drive you connect, copy to, then unplug — or a reputable cloud backup with version history — survives because the ransomware cannot touch it. And a backup is only real if it works, so test it occasionally by actually restoring a few files.
Beyond backups, a familiar set of habits dramatically reduces your risk — the same cyber hygiene that protects against threats generally:
If the worst happens, act calmly and in the right order. Panic leads to mistakes — including paying when you did not need to.
A note on paying: it is understandable to be tempted when precious files are at stake, which is exactly why prevention matters. The only way to be sure you never have to make that choice is to have a backup ready before anything goes wrong.
Ransomware encrypts your files and demands money to release them, and it usually gets in through everyday mistakes — a phishing email, a risky download, a missed update. The defences are squarely in your hands: keep regular backups with one copy offline, stay updated, be wary of links and attachments, and use strong authentication. If you are ever hit, disconnect, resist the urge to pay, restore from your backup and report it. Treat your backups as non-negotiable, and ransomware loses almost all of its power over you.
![[View image]](/img/ransomware-explained.jpg){kind=link}