Imagine opening your laptop and finding your photos, documents and work files will not open. Instead, a message says they have been locked and you must pay to get them back. That is ransomware.
It affects home users as well as businesses, schools and hospitals. Avoiding it does not require technical skill — just a few everyday habits: careful clicking, updated software, strong passwords, and a backup of the files that matter most.
What ransomware is in plain English
Ransomware is malicious software, often called malware, that locks you out of your own computer or files and demands payment to let you back in.
It usually works in one of two ways. First, it can encrypt your files — scramble them so they cannot be opened without a special key. Second, it can lock your whole screen or device.
A message then appears, asking for a ransom, often in cryptocurrency, for the key. It may include a deadline and a warning that the price will rise, or your files will be deleted. That pressure is deliberate. Some ransomware also steals a copy of your files first, then threatens to publish them unless you pay.
Ransomware is a form of malware, covered with other threats in our beginner’s guide to cybersecurity: https://darknet.cards/what-is-cybersecurity-beginners-guide/ Most malware tries to stay hidden. Ransomware wants you to notice it, because the demand is the whole point.
Paying does not guarantee you will get your files back: the attackers may not send the key, or it may not work. The UK’s National Cyber Security Centre and law enforcement advise against paying.
Ransomware can affect almost any device: a Windows laptop, a Mac, a phone or a tablet. Some attacks target large organisations; others target home users. No one is too small to be a target.
| Type | What happens | What you see |
|---|---|---|
| File-encrypting ransomware | Files are scrambled so they cannot be opened | Files will not open, or have strange new endings |
| Screen-locking ransomware | Your whole device is locked | A message fills the screen |
| Data-theft ransomware | A copy of your files is stolen first | A ransom message that also threatens to publish your files |
Real attacks can combine these approaches. Ransomware is not one single program — it is a family of attacks with the same idea: take something you need, and charge you to get it back.
How ransomware spreads
Phishing emails and messages. The most common route for home users. A message that looks like it comes from a delivery company, a bank or a colleague asks you to open an attachment or click a link, often with a false sense of urgency. Our guide explains the signs: https://darknet.cards/how-to-identify-and-avoid-phishing-attacks/
Malicious downloads and fake software. Ransomware can hide in software from unofficial websites, in pirated films, games and apps, and in fake update pop-ups. Only trust the official website or app store.
Infected websites and adverts. Some websites, including legitimate ones that have been compromised, can try to download malware through a misleading advert or link. Keeping your browser up to date helps.
Unpatched software. When a weakness is found in software, the maker releases a fix. If you do not install it, the weakness stays open, and attackers can use it to get in without you clicking anything.
Weak passwords and remote access. If remote access is switched on, or an account has a weak or reused password, an attacker may simply log in.
USB drives and shared files. A USB stick used in an infected computer can carry ransomware to the next computer it is plugged into, and shared folders can do the same across a network.
None of these routes requires you to do anything foolish. Phishing messages look genuine and fake updates look urgent. The aim is to know the risks, so you can build habits that catch most of them.
Warning signs that something is wrong
Files that will not open, or look different. Documents or photos suddenly will not open, or have strange new endings added to their names.
A ransom message on your screen. A message fills the screen, saying your files are locked and demanding payment. Any warning not to ask the police is part of the pressure. Do not follow it.
Your computer becomes very slow or behaves strangely. Your device slows down sharply, programs crash, or files seem to change while you watch.
You cannot reach shared folders or other devices. Files on a shared drive or connected external drive become inaccessible, or show the same strange endings.
Security software is switched off. Your antivirus stops working or will not open. Some ransomware switches off security tools first.
Unusual account activity. Password reset emails you did not request, or logins from places you do not recognise.
If you see one of these signs, do not panic, and do not pay straight away. Disconnect the device, as described below, and get help.
How to avoid ransomware
No single step makes you completely safe. What works is a small set of habits, used together.
1. Keep regular backups — and keep one copy offline. If ransomware locks your files, a good backup lets you wipe the device and restore them without paying. Keep one copy disconnected: an external drive you plug in only to back up, or a cloud backup service.
2. Think before you click. Most ransomware arrives through a link or attachment. Was I expecting this? Does the sender look right? If anything feels off, do not click — go to the company’s official website yourself.
3. Keep your software updated. Turn on automatic updates for your operating system, browser and apps, including your phone and tablet. Updates often fix the security weaknesses attackers use to get in.
4. Use strong, unique passwords and two-factor authentication. A strong password is long, hard to guess, and different everywhere; a password manager can create and remember them. Two-factor authentication adds a second check, such as a code from an app. See our guides: https://darknet.cards/how-to-create-strong-passwords-password-manager/ and https://darknet.cards/what-is-two-factor-authentication/
5. Use security software and keep it running. Install reputable antivirus or security software, keep it updated, and do not switch it off. It will not catch everything, but it catches a great deal.
6. Only download software from official sources. Get apps from the official app store, and programs from the maker’s own website. Avoid pirated software and unofficial download sites.
7. Be careful with USB drives and shared files. Do not plug in a USB drive you found, or one you do not trust, without scanning it first. Files from people you know can also be infected.
8. Limit what ransomware can reach. Protect remote access with a strong password and two-factor authentication, and switch it off when you do not need it.
9. Protect your personal information. The details that make phishing messages convincing — your name, workplace and the services you use — often come from information shared online. Our guide to digital privacy covers the steps: https://darknet.cards/what-is-digital-privacy-and-why-does-it-matter/
Start with backups and updates, then work through the rest over a few days.
What to do if ransomware happens to you
If you see a ransom message, or realise your files are locked, try to stay calm. These steps, in order, give you the best chance of recovering without paying.
1. Disconnect the device straight away. Unplug the network cable, switch off Wi-Fi, and disconnect from shared folders and external drives. This helps stop the ransomware spreading.
2. Do not pay the ransom. The NCSC and law enforcement do not encourage, endorse or condone paying. Paying does not guarantee your files will be unlocked, and the deadline in the message is part of the attack.
3. Report it. In the UK, report it to Action Fraud. In the US, report it to the FBI’s Internet Crime Complaint Center. If it affects your workplace, tell your IT team or manager straight away.
4. Get help from someone you trust. Ask a trusted IT professional, a knowledgeable friend, or your workplace IT team. Do not follow instructions in the ransom message, and do not download a “decryption tool” from a random website — some are scams. The NCSC’s guidance explains how organisations should prepare and recover: https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks
5. Preserve what you can, then clean the device. Do not delete the ransom message or unfamiliar files yet — they may be useful evidence. Note down what happened and when. Then, with professional help if needed, wipe the device and reinstall its operating system from a clean source.
6. Restore from your backup. Once the device is clean, restore your files. This is when all that backup work pays off. If you have no backup, a professional may be able to help.
7. Change your passwords. After the device is clean, change the passwords for your important accounts, starting with your email. Use strong, unique passwords, and turn on two-factor authentication.
8. Tell the people who need to know. If attackers may have stolen personal information — yours, or other people’s — tell those affected and, if it involves work, your employer.
These steps are recommended by official security agencies.
Common ransomware myths
“Ransomware only targets big companies.” Home users are targeted too. Attackers send automated phishing emails to thousands of people at once.
“My Mac or my phone cannot get ransomware.” No device is immune. Ransomware is most common on Windows, but Macs, phones and tablets can be affected too.
“Antivirus alone will protect me.” Security software is an important layer, but not enough on its own. It cannot stop you clicking a convincing phishing link.
“If I pay, I will definitely get my files back.” There is no guarantee. The attackers may not send the key, or the files may be damaged. Paying also marks you as someone who pays. Official guidance is not to pay.
“Ransomware only comes from suspicious websites.” It can come from an email that looks like it is from a delivery company, or a file shared by someone you know. Checking before you click matters more than judging a site by how it looks.
“Once I have been attacked, there is nothing I can do.” There is a great deal you can do: disconnect the device, report the attack, get help, clean the device, restore from a backup, and change your passwords.
“Backups are only for businesses.” Backups are for anyone with files they would miss — a family photo album, a university essay, a small business’s invoices.
Frequently asked questions
What is ransomware in simple words?
Ransomware is malicious software that locks your files or your whole device and demands payment to unlock them. Your files are usually encrypted — scrambled so they cannot be opened without a special key. Attackers promise to send the key if you pay, but there is no guarantee.
How does ransomware get on my computer?
Usually through a phishing email or message with a malicious attachment or link, through software from an unofficial source, through a fake update, or through a security weakness in software that has not been updated.
Can ransomware spread to other devices?
Yes. Some ransomware tries to spread to other computers, phones and drives on the same network. That is why the first step after an attack is to disconnect the infected device from the internet and from any shared network.
Should I pay the ransom?
Official advice from the NCSC and law enforcement is not to pay. Paying does not guarantee your files will be returned, and it encourages further attacks. Instead, disconnect the device, report the attack, get help, and restore from a backup if you have one.
Can ransomware be removed?
The ransomware itself can usually be removed by wiping the device and reinstalling the operating system. But removing it does not automatically unlock your files. That is why backups matter: they are usually the only reliable way to get your files back without paying.
How can I protect myself from ransomware?
Keep regular backups, with at least one copy offline. Keep your software updated. Think before you click links or open attachments. Use strong, unique passwords and two-factor authentication. Those habits, used together, protect you far better than any single tool.
The bottom line
Ransomware is a serious threat, but it is not a mystery. It locks your files, demands payment, and relies on pressure and panic to work. Once you understand how it spreads, you can see where to defend yourself.
Start with the two steps that matter most: back up the files you would miss, and keep your software updated. Then add the habits that stop most attacks: pause before you click, use strong passwords and two-factor authentication, and only download software from sources you trust.
If ransomware does reach you, do not pay in panic. Disconnect the device, report the attack, get help, and restore from your backup. A calm, steady response limits the damage.
Staying safe online is not about being perfect. It is about a few simple habits, repeated regularly, that make you a much harder target.