Glossary term
Ransomware
Subject: Technology, Cyber and Data, Cyber Risk and Incident Response
Also known as: Ransomware risk
Ransomware is malicious software that locks or encrypts a victim's data or systems, and often steals a copy, then demands payment to restore access or prevent publication.
Explanation
Attackers usually get in through phishing emails, stolen credentials, exposed remote-access services or unpatched software, then spend days moving through the network before triggering encryption. Many attacks now use double extortion: data is stolen first, so the victim faces both lost access and a threat of public leaks. Many gangs operate as criminal services, selling their tools to affiliates who share the payment. Ransomware risk is the chance and cost of such an event, including downtime, recovery work, legal duties, payments and reputational harm. Controls include multi-factor authentication, prompt patching, network segmentation, endpoint detection, and offline or immutable backups tested for restoration. Paying does not guarantee recovery and may breach sanctions rules if the group is listed, so many authorities discourage payment, and some countries require reporting. Insurers and supervisors asking about ransomware readiness tend to begin with one test: whether the backups have actually been restored.
Example
A hospital finds its patient system encrypted on a Monday morning, with a note demanding payment in cryptocurrency. Staff move to paper records while the IT team isolates infected machines. Clean backups from five days earlier are restored over a week. Meanwhile, legal counsel checks whether the group is sanctioned, and the hospital notifies the regulator and affected patients.
Not to be confused with
- Phishing
- Phishing is a way of gaining access, often through deceptive messages; ransomware is the payload that locks data once attackers are inside.