What is ransomware?

The basic idea

Ransomware is a category of malware built around a single, brutally effective idea: take something an organization cannot do without, make it unusable, and charge to give it back. In the most common form it encrypts files, scrambling them with strong cryptography so they are unreadable without a key the attacker holds. A ransom note then appears, demanding payment, almost always in cryptocurrency to make the money hard to trace, in exchange for the key.

The technology doing the encryption is not exotic. It is the same kind of cryptography that protects legitimate data every day. What makes ransomware devastating is not the math but the target. When it locks a spreadsheet, that is an inconvenience. When it locks a hospital's electronic health record, its imaging systems, and the tools clinicians use to prescribe and treat, it becomes a patient-safety emergency. The disruption, not the encryption itself, is the real weapon, and it is why ransomware has become the defining cyber threat to healthcare and critical services.

How a ransomware attack actually unfolds

The biggest misconception about ransomware is that it strikes instantly, like catching a virus from a bad download. In reality, a modern attack is a campaign that plays out over days or often weeks, and the encryption everyone pictures is the final act, not the first. Understanding the stages is the key to understanding how it is stopped.

• Initial access: the attacker gets in, usually through a phishing email, a stolen or guessed password, or an exposed remote-access service, rarely through dramatic hacking.
• Establish and explore: they settle in quietly, map the network, and identify the valuable systems and data, trying hard not to be noticed.
• Escalate and move: they steal more credentials, gain administrator rights, and move laterally from machine to machine toward the systems that matter most.
• Steal data: in almost every modern attack, they copy sensitive data out before encrypting anything, setting up a second form of extortion.
• Disable defenses: they turn off or evade security tools and, critically, locate and destroy backups so the victim cannot simply restore.
• Encrypt and demand: only now do they trigger encryption across the network, lock everyone out, and leave the ransom note.

Double extortion: why backups alone stopped being enough

Early ransomware had a simple logic for the victim: if you kept good backups, you could restore your systems and refuse to pay. Attackers adapted. Today the dominant model is double extortion, where the attacker steals a copy of your data before encrypting it, then threatens to publish or sell that data on a leak site if you do not pay, even if you can recover perfectly from backups.

This changed the math entirely. An organization now faces two distinct harms from a single attack: the operational downtime of locked systems, and a data breach of everything that was stolen. Good backups still solve the first problem, but they do nothing about the second, because the leak threat survives even a flawless restore. Some groups push further into triple extortion, adding threats to notify customers, patients, or regulators directly, or to launch denial-of-service attacks, to pile on pressure. The practical lesson is that stopping the theft of data now matters as much as being able to recover from encryption.

Who is behind it, and why there is so much of it

A large share of today's attacks come from a model called ransomware-as-a-service, in which skilled developers build the ransomware, the payment infrastructure, and the leak sites, then rent all of it to affiliates who carry out the attacks for a share of the proceeds. This specialization has industrialized ransomware: an attacker no longer needs to be able to write malware to launch a damaging campaign, which is why there is a constant stream of incidents from a rotating cast of groups.

For a defender, this has an important implication. Because the group and the affiliate behind any given attack change constantly, chasing individual signatures is a losing game. What stays consistent is the shape of the attack chain, the access, the exploration, the lateral movement, the exfiltration, the encryption, and that is where effective defense concentrates.

Why healthcare is hit so hard

Healthcare has become one of ransomware's most-targeted sectors, and the reasons are structural. Hospitals hold enormously valuable personal and medical data, they run services that cannot simply be switched off, and they operate thousands of connected medical devices that cannot run security software and are therefore easy entry points. On top of that, the pressure to restore care quickly makes extortion more likely to succeed. The 2024 attack on Change Healthcare disrupted care and billing across the entire US system and exposed data on an estimated 190 million-plus people, a scale that shows how far a single healthcare ransomware incident can reach.

How organizations defend against it

Because an attack unfolds in stages, defense works best when it addresses more than the final encryption. A strong posture combines three layers, and no single product does all three well. Prevention reduces the chance of initial access and early movement through patching, strong authentication, email filtering, and locking down remote access. It is necessary but never perfect, so it cannot be the whole plan. Containment limits the damage once an attacker is inside, detecting the quiet mid-stage activity and isolating the threat before it can spread or finish encrypting. And recovery determines whether an attack that succeeds is a crisis or an inconvenience, through the ability to restore clean systems from backups an attacker could not reach.

That last layer is the one that most often decides the outcome. Attackers target backups first precisely because a victim who can restore has no reason to pay. Keeping backups verified, immutable, and air-gapped, out of the attacker's reach, is what preserves recovery as a real option and removes the leverage behind the ransom demand. This combination of fast containment and independent, validated recovery is the essence of ransomware resilience, the idea that an attack should become a contained incident rather than a shutdown.