One morning everything on the computer works fine. By afternoon, every file has a strange new extension, and a text file on the desktop is demanding payment in cryptocurrency to get them back. Nothing looks broken from the outside. The screen still turns on, the mouse still moves. It’s just that none of your files belong to you anymore.
That’s ransomware, and it’s one of the more unsettling forms of malware because it doesn’t try to hide. It wants you to know it’s there. It wants you to pay. Understanding how it gets in, and why sending money doesn’t always fix the problem, is the difference between treating it as a scary abstraction and actually being able to defend against it.
What ransomware actually does
Ransomware is malicious software that locks you out of your own files, usually by encrypting them, and then demands payment for the key to open them back up. Some versions also threaten to leak stolen files publicly if you don’t pay, which adds a privacy problem on top of the access problem.
It can hit a single home computer or an entire organization’s network at once. Schools, hospitals, city governments, and businesses have all been targeted. If you want a sense of how this plays out at an institutional level, Ransomware and School Networks: What Families Should Know if a District Gets Hit walks through what happens when a district is targeted and what it means for families connected to it.
How ransomware gets in
Ransomware rarely breaks in through some dramatic hack. In most cases, it walks through a door someone opened for it, usually without realizing it.
Phishing emails and messages. This is still one of the most common entry points. An email looks like it’s from a delivery company, a bank, or a coworker, and it pushes you to open an attachment or click a link right now. That attachment or link is the delivery mechanism. Once opened, it can install the malware in the background while everything still looks normal on screen.
Malicious or compromised websites. Sometimes just visiting a website that’s been compromised is enough, especially if your browser or operating system is out of date and has unpatched security holes. This is sometimes called a “drive-by download,” because you don’t have to click anything for it to happen.
Infected downloads. Pirated software, cracked games, and free tools from untrustworthy sites are common carriers. So are fake versions of legitimate apps offered outside official app stores.
Weak or reused passwords and exposed remote access. Attackers also get in through more technical routes, like guessing weak passwords on remote access tools, or using credentials that were exposed in an unrelated data breach. This is part of why reusing passwords across accounts is risky: one leaked password can end up being tried everywhere.
Infected USB drives and shared devices. Less common now, but still a route, particularly on shared or public computers.
Notice that almost none of these require the attacker to be a genius. They require you to be busy, distracted, or trusting for about three seconds. That’s the whole design.
Why paying isn’t a simple fix
When files are locked and the countdown timer on the ransom note is ticking, paying can feel like the obvious way out. It’s worth understanding why that’s more complicated than it looks.
There’s no guarantee you get your files back. You’re dealing with criminals. Some do provide a working decryption key after payment, because a reputation for “honoring” the deal keeps future victims paying. Others take the money and give you nothing, or hand over a key that only partially works.
Paying doesn’t undo a data leak. If the attackers already copied your files before locking them, paying to open your own copies back up does nothing about the copies they still have. A leak-and-extortion threat isn’t solved by a decryption key.
It can mark you as a payer. Once attackers know an individual or organization is willing to pay, that target can become more attractive for a repeat attempt down the line.
It funds more of the same. Ransom payments finance the next round of attacks against the next set of victims.
Law enforcement and security professionals generally advise against paying when possible, precisely because of these issues. There are other paths back to your files, including restoring from a backup or working with a professional on remediation, which is part of why prevention and backups matter so much before an attack ever happens.
None of this is a judgment on anyone who’s paid a ransom under real pressure, especially when critical data or a child’s school records were on the line. It’s simply the reason prevention has to carry most of the weight here. A cure that might not work isn’t a substitute for not getting infected in the first place.
Building layers of defense
No single setting or app makes any device immune to ransomware. What actually helps is stacking several habits so that if one fails, another catches it.
Back up your files regularly, and keep at least one backup disconnected from your main network. This is the single most effective protection against ransomware. If your files are encrypted but you have a recent backup stored separately, the ransom demand loses most of its power. Cloud backups and an external drive that isn’t always plugged in both work.
Keep software and operating systems updated. Many ransomware infections rely on known security holes that a software update would have closed. Turning on automatic updates removes the “I’ll do it later” problem.
Be skeptical of unexpected attachments and links, even ones that appear to come from people you know. Verify through a separate channel before opening anything urgent-sounding.
Use strong, unique passwords and enable multi-factor authentication wherever it’s offered, especially on email and any account tied to remote access. If you’re resetting logins for kids at the start of a school year, Resetting Your Child’s School Portal and App Passwords for the New Year is a good companion piece for getting the whole household’s credentials in order.
Avoid pirated software and downloads from unofficial sources. If a deal on software looks too good to be legal, treat it as a risk, not a bargain.
Be cautious on public networks. Public wifi at airports, hotels, and cafes can expose devices to more risk, particularly if file sharing is left on or the network isn’t secured. Public Wi-Fi at Airports and Hotels: A Late-Summer Travel Safety Refresher covers the specifics.
If you suspect infection, disconnect the device from the network immediately and get help from a professional before doing anything else, including paying. Acting fast to isolate the device can sometimes limit how far it spreads, especially on a shared home or school network.
The habit that matters most
Ransomware succeeds by exploiting a moment of inattention, not a lack of intelligence. Nobody who’s ever been hit clicked the link because they’re careless; they clicked it because it looked exactly like a hundred other emails they get every week. The defense isn’t becoming paranoid about every message that lands in your inbox. It’s building a few boring, reliable habits, backups chief among them, so that one bad click on one bad day doesn’t turn into a catastrophe.
A quick safety note
This article is general information, not professional security, legal, or medical advice. No single tool or setting makes anyone completely safe; security works in layers. If you are dealing with a live incident, such as active fraud, ransomware, or a child in danger, contact the appropriate professionals or authorities. For a threat to a child, report it to the NCMEC CyberTipline at report.cybertip.org and to local law enforcement.
