Ransomware is crimeware that locks or steals data and then pressures the victim for restoration or for continued silence.
Impact is halted work and exposed copies, and recovery depends on isolation, clean backups, and a practiced rebuild, not on paying.
How it works
Files may be encrypted, systems may be unusable, and copies may be taken so the attacker can threaten publication.
Paying is not a recovery plan, because it does not guarantee return of data and it funds the next crime.
A workable recovery isolates affected machines, restores from backups that were kept out of reach, and rebuilds what cannot be trusted.
Legal reporting and customer notice follow the incident plan, while negotiator tactics and payment instructions stay out of this explanation.
Concrete examples
- A clinic postpones appointments because imaging files are encrypted and the imaging network is isolated.
- A manufacturer stops a line when shared folders lock and only an offline backup from yesterday remains usable.
- A school discovers that marks were copied as well as locked, so the harm is disclosure plus downtime.
Protective measures
- Keep offline or immutable backups and test a restore of a real system at least once each quarter.
- Isolate a suspected host from file shares and identity systems as soon as encryption or a ransom note appears.
- Rebuild from known clean media rather than trusting a machine that already ran the crimeware.
- Follow your legal and insurance notice duties, and do not treat payment as the path back to operations.