A ransomware attack is a weeks-long intrusion that ends in encryption, not a single event. The ten stages from initial access to extortion, the tools used at each, how long it takes, and where defenders can break the chain.

Ransomware did not start with Bitcoin. It started in 1989, on floppy disks mailed to AIDS researchers, and spent thirty years evolving into the multibillion-dollar criminal industry we know today.

Ransomware is malware that locks organisations out of their data and demands payment, and in its modern form steals the data first. What it is, how an attack unfolds, who gets hit, what it costs and why fewer victims pay, with live figures from 9,500 confirmed attacks.