Definition
Ransomware is malicious software that locks your precious files on a computer or smartphone by encrypting them without your say, then demands money to unlock them. The name combines 'ransom,' the money demanded to free a hostage, with 'software.'
How Does It Take a Computer Hostage?
The documents and photos you make every day are stored like a diary in a drawer: you can open them easily whenever you want. But the moment ransomware infects your computer, the program scrambles the contents of countless files into complicated gibberish in an instant. File extensions change to something strange, and no matter how many times you click, you can't read a thing inside.
Once every file is locked, a threatening message appears on screen with a countdown timer, like a ticking time bomb. It warns that if you don't send money in cryptocurrency within the deadline, the key needed to recover your files will be deleted for good. Instead of stealing your belongings and running off, it's like putting a lock on your things and charging you for the key.
It often sneaks into a computer system when you carelessly open an attachment in an email from an unknown sender, or even just visit a poorly secured website.
A Little More Precisely
To be a little more precise, ransomware works by turning public-key encryption upside down. Banks and intelligence agencies use this technology to keep information safe. In it, the key that locks and the key that unlocks are two different keys. Usually, ransomware locks your files with a fast, ordinary cipher, then locks that cipher's key again with the hacker's public key. The only key that can open it is held by the hacker alone.
That's why, with well-made ransomware, breaking the encryption without the hacker's key is next to impossible. With modern encryption algorithms, even a supercomputer would need an unimaginably long time to guess the key. Still, in some cases researchers have found a design flaw in a ransomware and released a free recovery tool.
These days, it doesn't stop at locking files. It has evolved into double extortion: the attackers copy sensitive personal data or company secrets to their own servers in advance, then threaten to leak them online if you don't pay.
Will Paying Really Fix It?
If ransomware locks all your files, is quietly sending the hacker money the right answer? Sadly, there is no guarantee at all that paying will bring your files back intact. It's not rare for criminals to take the money and vanish, or to hand over a key that doesn't work. A victim who pays easily is also an easy target, and is likely to be attacked again.
That's why the key defense for reducing ransomware damage is backing up to storage that is disconnected from the network. You keep backup copies on an external hard drive or separate storage that is cut off from your computer's network. Even if your computer is attacked, you can wipe the system and restore the backup files, bringing your files back without paying a ransom. A backup can't stop the threat of leaking data that has already been stolen, though.
Careful prevention habits matter most: keep your operating system and security software up to date at all times, and avoid downloading programs from unknown sources.
Common misconceptions
Even if you get hit by ransomware, you can safely get your files back if you send the ransom the hacker demands.
Hackers are criminals, so they often take the money and vanish or hand over a key that doesn't work, and victims who pay without a fight are likely to become targets again.
Where you meet it
Someone opens an email attachment disguised as a delivery notice or a job application, and every document on the computer gets locked with encryption.
Attackers paralyze a company's servers, hold important business data hostage, and demand a huge amount of cryptocurrency to restore it.
In one sentence
Ransomware is malicious software that locks files with encryption, holds them hostage, and demands money, and regular offline backups are the key defense for reducing the damage.