What is ransomware?
Ransomware is malware that encrypts an organization’s files and systems, and often steals data first, then demands payment to restore access or to keep the data from being published.
How it works
Initial access usually comes through phishing, stolen credentials, exposed remote access or an unpatched system. Attackers then move laterally, disable backups and deploy the encryption across as many systems as they can reach.
Resilience depends on offline backups, segmentation, endpoint detection and a rehearsed incident response plan.
Why it matters
A ransomware attack can halt operations for days or weeks. Many begin with one person’s click or one reused password, which is why human risk is part of ransomware prevention.
