Ransomware

Ransomware locks a company's data and demands payment to release it. The ransom is asked in cryptocurrency because it makes the money harder to follow — which is exactly why attackers use it.

Term

description · examples · notes

Ransomware locks a company's data and demands payment to release it. The ransom is asked in cryptocurrency because it makes the money harder to follow — which is exactly why attackers use it.

Description

The locking is only part of the problem. Before encrypting the files, the attacker takes copies of the data and threatens to publish them if nothing is paid — double extortion. Some ransomware groups sell their whole operation to affiliates as a package (ransomware as a service), so attacks are now run by people with no particular technical skill. There are many of them, and they are no less dangerous.

What follows is not a technical fault but a standstill that lasts for weeks. Hospitals lose access to records and to their operating schedule and divert patients, factories stop, municipalities cannot serve citizens — it ends the same way everywhere. A ransomware attack can also close a company down, under lawsuits and a ruined reputation.

Examples

The power distribution company is locked, a ransom demand is posted, everything stops: emergency callouts, contact with customers, routine work, billing.
Ransomware inside a routine update from a software vendor — the whole supply chain is hit.
Internal company documents on leak sites, because the ransom went unpaid.
A production line stands still because the control computers are unusable.

Notes

A backup sitting on the same server or in the same cloud is not protection. Ransomware locks that too. Restores are tested before the incident, not after.
Paying the ransom guarantees neither a working key nor that the data stops circulating on the dark web. It guarantees one thing only — funding the attack on the next victim.

Mentioned in the news

Techniques

carried out with 17

Techniques used to carry it out. Select one to open its page.

Defenses

countered by 18

How it is defended against. Select one to open its page.