Ransomware is no longer a lone operator’s tool but a division-of-labour business, with access brokers, developers and negotiators.<\/p>\n
Data is copied before it is encrypted. Even an organisation that can restore cleanly is then under pressure, because publication is threatened. Backups alone no longer solve the problem.<\/p>\n","protected":false},"featured_media":0,"template":"","glossary_intl_set":[],"glossary_intl_cluster":[392],"glossary_intl_theme":[],"class_list":["post-29159","glossary_intl","type-glossary_intl","status-publish","hentry","glossary_intl_cluster-cybersecurity"],"acf":{"card_description":"Malicious software that encrypts data and demands a ransom.","nav_theme":"","nav_subtheme":"","dataset_version":"","term_inline":"","term_plural":false,"heading_overrides":null,"synonyms":null,"lead_definition":"Ransomware is malicious software that encrypts data or locks systems and demands a ransom to release them. Modern campaigns additionally threaten to publish data they exfiltrated beforehand.","at_a_glance":[{"bullet":"The way in is usually phishing<\/b> or an unpatched remote access point."},{"bullet":"Double extortion: copy first, then encrypt."},{"bullet":"Offline backups are the only copy an attacker cannot encrypt along with the rest."}],"intro_answer":"","steps_answer":"","steps":null,"examples":[{"example":"One click on an attachment encrypts the whole department's file share overnight."},{"example":"An unpatched VPN appliance opens the network without anyone having to click anything."}],"misconception":[{"myth":"\u201cWe have backups, so we are protected against ransomware.\u201d","reality":"Backups help against encryption, not against publication of copied data. And a backup reachable online gets encrypted along with everything else."}],"faq":[{"q":"Should you pay the ransom?","a":"Authorities advise against it: paying funds the business model and guarantees nothing. CISA StopRansomware<\/a> collects practical guidance."},{"q":"Is a ransomware incident reportable?","a":"Entities in scope of the NIS2 Directive<\/a> face short reporting deadlines. Whether your organisation is in scope is a question for legal."}],"compare_answer":"","compare":null,"variants":null,"signals_answer":"","signals":null,"protect_answer":"","prevent":null,"incident":null,"related_terms":null,"pillar_link":null,"sources":[{"publisher":"","name":"CISA StopRansomware","url":"https:\/\/www.cisa.gov\/stopransomware","doc_type":"","group":"used"},{"publisher":"","name":"NIS2 Directive (EUR-Lex)","url":"https:\/\/eur-lex.europa.eu\/eli\/dir\/2022\/2555\/oj","doc_type":"","group":"used"},{"publisher":"","name":"BSI IT-Grundschutz","url":"https:\/\/www.bsi.bund.de\/DE\/Themen\/Unternehmen-und-Organisationen\/Standards-und-Zertifizierung\/IT-Grundschutz\/it-grundschutz_node.html","doc_type":"","group":"used"}],"reviewer":{"name":"Jakub Novak","qualification":"IT security","date":"2026-06-01"},"disclaimer":""},"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t