What is ransomware?
Ransomware is malicious software that encrypts a victim's data and demands a ransom to unlock it.
TL;DR
- Ransomware is malware that locks or encrypts a victim's data and systems, then demands a ransom payment (usually in cryptocurrency) for restoring access.
- It often enters through phishing, exposed credentials, or unpatched systems — including via vendors.
- Preparation — backups, patching, monitoring — matters far more than negotiation.
Short definition
Ransomware is a type of malware that locks or encrypts a victim's data and systems, then demands a ransom payment (usually in cryptocurrency) as a condition for restoring access.
How does double extortion ransomware work?
Modern ransomware attacks often include data theft (double extortion): if the victim does not pay, the stolen data is leaked or sold on the darknet. Common entry points are leaked credentials, phishing emails, and unpatched system vulnerabilities.
Reducing ransomware risk starts with the basics: monitoring the attack surface, patching vulnerabilities, securing credentials, and keeping tested data backups. Security ratings help show whether these basics are in place across your organization and its vendors.
What are some practical examples?
- A hospital is temporarily paralyzed because its medical records system is encrypted by ransomware.
- A manufacturer loses production data due to leaked remote desktop credentials.
- Customer data is sold on the darknet after the victim refuses to pay the ransom.
Learn more
Frequently asked questions
Related terms
Get your free security rating
Run a free CyberRank security rating for any organisation and see the same vendor risk signals our customers use.
Get your free security rating