Ransomware encrypts your files and demands payment to unlock them.
Ransomware typically arrives via phishing emails with malicious attachments, or by exploiting exposed remote desktop connections. Once executed, it silently maps the file system and encrypts documents, photos, databases, and backups — often over days or weeks — before displaying the ransom demand.
Paying the ransom does not guarantee file recovery. A significant portion of victims who pay receive a broken decryption tool or nothing at all. Payment also funds criminal operations and marks you as someone willing to pay, potentially making you a future target.
Modern ransomware groups often use double extortion: they encrypt your files AND exfiltrate a copy of your data first, threatening to publish it if you don't pay. This means even organizations with good backups face pressure because recovery does not prevent the data leak.
The only fully reliable defense against ransomware is offline backups — copies of your data stored on a device not connected to your network. Cloud sync services are not a substitute because ransomware encryption propagates to synced cloud files just as it does to local files.