Introduction

Imagine opening your laptop to find every photo, document, and spreadsheet on it will no longer open. In their place is a message: your files have been encrypted, and you can only get them back by paying a ransom, usually in cryptocurrency, before a deadline. That is ransomware, and it is one of the most damaging threats facing home users and small businesses today.
Ransomware does not only hit big companies. It targets anyone with files worth protecting: family photos, tax records, work documents, a small business’s customer list. The good news is that it is also one of the most preventable cyber threats, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI publish clear, practical guidance on stopping it.

What Is Ransomware?

Ransomware is a type of malicious software — malware — that prevents you from accessing your computer files, systems, or networks and demands you pay a ransom for their return. That is the FBI’s own definition: it locks you out, and it asks for money.
A typical attack unfolds in four stages. First, the ransomware gets in through a phishing email, a malicious download, an unpatched software flaw, or a stolen login. Next, it tries to spread to other computers and shared drives — and it often hunts for your backups, too. Then it scrambles your files so they cannot be opened without a decryption key that only the attacker holds; encrypted files often get renamed with a strange new extension. Finally, a ransom note appears with payment instructions and a deadline.
Some modern attacks add a second layer of pressure, called double extortion: the attackers steal a copy of your data before encrypting it, then threaten to publish it if you do not pay. In those cases, restoring from backup alone does not fully undo the damage, which is why prevention matters so much more than recovery.

How Ransomware Spreads

Ransomware rarely breaks through a well-protected computer by force. It usually walks in through a door that was left open. CISA’s guidance covers the same entry points again and again, because they are the ones attackers actually use.
Phishing emails. This is the most common entry point. A fake email, text, or website pretends to be from a legitimate company, a delivery service, or someone you know, and tricks you into clicking a link or opening an attachment — often by creating urgency around an unpaid invoice or a delivery problem. One click can start the infection. Our guide to How to Spot a Phishing Email walks through the red flags to check before you click anything.
Drive-by downloads. Ransomware can also arrive through malicious code on a compromised or fake website that downloads onto your computer when you visit it, sometimes without any obvious click. Sticking to sites you trust and keeping your browser updated reduces this risk considerably.
Unpatched software. A patch is a fix a software maker releases to close a known security flaw. Attackers look for computers running old, unpatched software, because the flaws are public knowledge.
Exposed remote access. Remote desktop services (RDP) and virtual private networks (VPNs) exposed to the internet with weak or stolen passwords are a frequent entry point, especially in attacks on businesses. In October 2026, CISA and the FBI published a joint advisory on SafePay ransomware (AA26-293A) describing exactly this pattern: attackers got in through exposed credentials and VPN accounts compromised through phishing, then disabled security software and copied data before encrypting it.
Stolen logins. Usernames and passwords leaked in data breaches are bought, sold, and reused by attackers. If you reuse the same password across accounts, a breach on one site can hand attackers the keys to your email and cloud storage.
Once inside, ransomware does not always strike immediately. Attackers may spend hours or days exploring the network, stealing credentials, and tampering with backups before they launch the visible encryption — which is why early warning signs matter.

Warning Signs of a Ransomware Infection

Sometimes the first sign is the ransom note itself. But there are earlier clues worth knowing, especially if several appear together:

• Files renamed or refusing to open. Documents, photos, and shared-drive files suddenly have unfamiliar extensions (like .locked or a random string of characters) or display errors when you try to open them. Many files failing at once is far more concerning than a single damaged file.
• A ransom note appears. A text file or pop-up demanding payment may show up on your desktop, in folders, or inside an application. Do not delete it — it is evidence, and security experts use it to identify the ransomware strain. Some strains have free decryption tools, and the note is how experts tell.
• Security software or backups stop working. Antivirus gets disabled, backup software fails, or saved backup copies disappear. Ransomware deliberately targets backups to make paying seem like the only option.
  One symptom alone is not proof — a corrupted file or a crashed program can have innocent causes. But renamed files plus a ransom note, or disabled security software plus strange logins, should be treated as an active incident.

How to Protect Your Computer From Ransomware

Ransomware prevention is not one product. It is a set of layers that work together, so that if one layer fails, another catches the attack.

1. Back up your files — and keep backups offline

This is the single most important defense. Back up your system and important files frequently, and verify the backups regularly. If your computer is infected, clean backups let you restore everything without paying.
The critical detail: store backups separately from your computer and network. CISA’s best practice is to keep backups on a separate device that cannot be accessed from the network, such as an external hard drive — and disconnect it once the backup is complete. Ransomware actively hunts for connected backups, so a backup drive left plugged in is not a safe backup. For phones, see our guide on How to Back Up Your Android Phone Before a Factory Reset for backup habits that apply to any device.

2. Keep everything updated

Turn on automatic updates for your operating system, browser, office software, and router. Patch promptly, because the flaws patches fix are exactly the ones attackers exploit.

3. Use strong, unique passwords and two-factor authentication

Use a long, unique password for every account, and store them in a password manager rather than reusing one password everywhere. Then turn on two-factor authentication (2FA) wherever it is offered — especially for email, cloud storage, and remote access. Our guides explain How to Create Strong Passwords and How to Enable Two-Factor Authentication step by step.

4. Treat email attachments and links with suspicion

Do not open attachments or click links in unexpected emails, even if they appear to come from someone you know. Check the sender’s address carefully, hover over links before clicking, and when in doubt, contact the supposed sender through a channel you trust.

5. Use and maintain security software

Install antivirus software, a firewall, and email filters — and keep them updated. Security software will not stop every attack, but it reduces malicious traffic and catches many known ransomware variants before they run.

6. Limit remote access and administrator privileges

If you do not use Remote Desktop, turn it off. If you must use it, protect it with strong authentication and MFA, and do not expose it directly to the internet. Avoid using an administrator account for everyday browsing and email — a standard account limits what malware can do if it gets in.

7. Be careful what you download

Only download software from official vendor sites or trusted app stores. Avoid pirated software and “free” versions of paid programs from unfamiliar sites — these are common ransomware carriers.

What to Do If You Are Infected

If a ransom note appears, stay calm and act in this order. Speed matters, because the ransomware may still be spreading to connected drives and other computers.

1. Disconnect immediately. Unplug the network cable and turn off Wi-Fi. Remove external drives. This stops the ransomware from reaching other devices and your backups. CISA’s guidance prefers disconnecting over powering off, because powering off destroys evidence held in memory.
2. Do not pay straight away. The FBI does not support paying a ransom in response to a ransomware attack. Paying does not guarantee you will get any data back, it can mark you as someone willing to pay, and it may fund further criminal activity.
3. Photograph the ransom note. Use your phone to photograph the note, including any email address or ID it shows. This helps experts identify the strain — and some older strains have free decryption tools.
4. Report it. In the United States, report ransomware to the FBI’s Internet Crime Complaint Center at ic3.gov, or contact your local FBI field office. CISA also accepts reports through its incident reporting system.
5. Get expert help before wiping anything. Contact a trusted IT professional or your computer manufacturer’s support. Our guide to How to Remove Malware From a Windows PC covers the cleanup steps, but with ransomware, get professional advice first — wiping the drive before identifying the strain can destroy your chance of recovering files with a free decryptor.
6. Restore from backup. Once the infection is contained and the machine is clean, restore your files from a backup you have verified is free of malware.
7. Change your passwords — from a clean device. After the infection is dealt with, change passwords for your important accounts from a different, clean device, starting with email and banking.

Frequently Asked Questions

Can ransomware infect a phone or a Mac?

Yes. While Windows computers are the most common target, ransomware exists for macOS, Android, and other platforms. The same defenses apply: updates, caution with links and downloads, strong passwords with 2FA, and backups.

Does paying the ransom guarantee my files back?

No. The FBI states plainly that paying a ransom does not guarantee you will get any data back. Some victims who pay receive only some files back, or nothing at all.

Is there a free tool to decrypt ransomware?

Sometimes. Security researchers publish free decryptors for some older strains, and law enforcement occasionally releases decryption keys after taking down a ransomware operation. That is why you should get expert help before wiping an infected computer.

Bottom Line

Ransomware works by taking something you cannot replace — your files — and holding it hostage. The best defense is making that hostage worthless to the attacker: keep regular backups stored offline and disconnected, keep your software updated, use strong unique passwords with two-factor authentication, and treat unexpected emails with suspicion.
If it does happen, disconnect fast, do not pay in a panic, photograph the ransom note, report it to the FBI at ic3.gov, and get expert help before wiping anything. With tested backups, most people and small businesses can recover without paying.