Devices and protection
What ransomware actually does
Ransomware is software that scrambles your files and demands payment for the key. Most attacks start days before anyone sees a ransom note.
1 min readExplainer
The short version
Ransomware locks your files and, more and more often, steals a copy first. Here is how an attack unfolds.
How an attack unfolds
Most attacks begin quietly. Someone signs in with a stolen password, or a phishing email gets software onto one computer. The attackers then spend days or weeks looking around: finding the file server, the backups and the administrator accounts.
When they are ready, often on a Friday night or before a holiday, they encrypt as many files as they can reach at once and leave a note with payment instructions.
Why backups alone are no longer enough
Attackers learned that businesses with good backups did not pay. Many now copy your data out first and threaten to publish it. They also go after the backups themselves, deleting or encrypting any they can reach.
That is why recovery depends on backups the attackers cannot touch, and protection depends on catching them during the quiet part, before the encryption starts.
What you can do today
- Turn on multi-factor authentication everywhere, especially for remote access and email.
- Make sure at least one copy of your backups is kept where a compromised account cannot delete it.
- Decide now who you would call first if a ransom note appeared tomorrow.
Talk to us about your technology
Tell us what you run today and what is getting in the way. We will get back to you about how we can help.