What is ransomware? A plain-English guide to how it works, who it hits and what it costs

Ransomware is malicious software that locks an organisation out of its own data or systems, usually by encrypting them, and demands a payment to restore access. In its modern form it also steals the data first and threatens to publish it, so that a victim with good backups can still be extorted. It is the most disruptive category of cybercrime of the past decade, and it is a business, not a virus.

Ransomnews has independently confirmed more than 9,500 ransomware attacks since 2018, running at roughly 1,400 to 1,550 a year since 2023, and that is a floor rather than a census. This guide explains what ransomware is in plain terms, how an attack actually unfolds, who gets hit, what it costs, and what has changed. Every number links to the live dataset it comes from.

Ransomware, defined

Ransomware is malware that denies a victim access to systems or information, typically by encrypting files with a key only the attacker holds, and demands payment, almost always in cryptocurrency, in exchange for restoring access. The word describes the software, but the crime is extortion, and the software is only one of the levers. Since about 2019 most serious operators also copy data out of the network before encrypting anything, then threaten to publish it on a public leak site if the ransom is not paid. Some now skip encryption entirely and extort on the stolen data alone.

The basic shape of the crime is ancient. The apparatus that makes it work at planetary scale is modern, and it is the combination of the two, a shakedown delivered through strong cryptography and global payment rails, that turned a nuisance from the floppy-disk era into a multi-billion-dollar industry.

The types of ransomware

• Crypto-ransomware encrypts files and demands payment for the key. This is what most people mean by the word, and nearly every major family since CryptoLocker in 2013 belongs here.
• Locker ransomware blocks access to the device or screen rather than the files. Common on consumer devices a decade ago, now rare against organisations.
• Double extortion combines encryption with data theft and a threat to publish. It has been the default model for serious operators since 2020. How double extortion works is covered in its own explainer.
• Triple extortion adds a third pressure: DDoS attacks on the victim’s public services, direct contact with customers or patients whose data was stolen, or complaints filed with regulators to manufacture legal exposure.
• Pure data extortion drops encryption altogether. The attacker steals data and sells silence, or increasingly just sells the data. Several of the most active operations of 2026 work this way; see the shift to encryption-less extortion.
• Ransomware-as-a-service (RaaS) is not a type of malware but the business model behind most of it: a core group builds the malware and infrastructure and rents it to affiliates who run the intrusions, for a cut of each ransom. What RaaS is and why it matters is explained separately.

Why ransomware works

Three ingredients made ransomware viable as a business and hard to stamp out as a phenomenon.

Strong, asymmetric cryptography. Modern ransomware uses well-understood ciphers, AES or ChaCha20 for the files and RSA or Curve25519 to wrap the keys, in ways that are mathematically sound. Without the attacker’s private key, the files are unrecoverable in any practical timeframe. Free decryptors exist for some families whose authors made mistakes, and law enforcement occasionally seizes keys, but recovery without paying or restoring from backup is the exception.

Cryptocurrency. Bitcoin, and later Monero, gave criminals a way to receive large international payments without a bank that can freeze, reverse or report them. Tracing has improved a great deal, and blockchain analysis now does real damage to laundering operations, but the fundamental affordance of a pseudonymous, irreversible payment remains. Tracing ransom payments on-chain shows what investigators can and cannot see.

An economy of specialists. The ecosystem is divided into roles: initial-access brokers who sell footholds, developers who write the malware, affiliates who run the intrusions, negotiators, money launderers and even PR people who handle journalists. The crime is industrialised, and that division of labour is why a takedown of one brand rarely reduces the volume of attacks for long.

What a ransomware attack actually looks like

The popular image is a sudden skull on a screen. The reality is closer to a hostile takeover that runs for days or weeks before anyone notices. A typical intrusion has six phases.

1. Initial access through a phishing email, a stolen VPN login, an exposed remote desktop service, or an unpatched firewall or VPN appliance. Increasingly the login comes from an infostealer log: a stolen session cookie walks straight past multi-factor authentication.
2. Reconnaissance and privilege escalation. The attacker maps the network, harvests credentials and works toward domain-administrator rights, mostly with legitimate administration tools so the activity blends in.
3. Data theft. Before anything is encrypted, gigabytes to terabytes of sensitive files are copied out to attacker-controlled storage. This is the stage victims most often underestimate.
4. Backup destruction. Shadow copies are deleted, backup servers are wiped or encrypted, and cloud snapshots are removed if the keys are available. The aim is to leave payment as the only recovery path.
5. Encryption. At a chosen moment, often a Friday night or a public holiday, the payload is pushed across the estate, frequently straight onto the ESXi hypervisors so that hundreds of virtual servers die at once.
6. Extortion. A ransom note points to a Tor negotiation portal with a countdown. If the victim refuses, the stolen data is published in instalments on the group’s leak site.

The stage-by-stage version, with the tools used at each step and where defenders can break the chain, is in How ransomware works: the full attack lifecycle.

Who gets hit

Effectively everyone, with a clear bias toward organisations that can least afford downtime. In the Ransomnews confirmed dataset, healthcare, government, manufacturing and education are the four largest sectors, and together they account for more than half of all confirmed incidents. The United States accounts for roughly half of confirmed attacks worldwide, partly because it is heavily targeted and partly because its breach-notification laws force incidents onto the public record that would stay private elsewhere.

Two factors drive target selection. The first is time sensitivity: a hospital that cannot dispatch ambulances or a factory that cannot run its line is more likely to pay, and to pay quickly. The second is blast radius: compromising one managed service provider or one widely used piece of software yields hundreds of downstream victims from a single intrusion, which is how Cl0p turned one MOVEit Transfer vulnerability into the largest campaign of 2023.

How much ransomware costs

The ransom is rarely the largest line item. Recovery, downtime, forensics, rebuilding infrastructure, legal fees, regulatory exposure, customer notification and reputational damage usually exceed the ransom by several multiples, whether or not it is paid. Where a ransom figure is on the public record in the Ransomnews dataset, the median demand that victims paid was about $250,000 and the median they walked away from was about $700,000; Coveware’s negotiation caseload put the median payment at $150,000 in the second quarter of 2026.

Paying does not reliably restore data. Decryptors are buggy, slow or partial, and the promise to delete stolen data is never verifiable. That is one reason payment rates have collapsed: among confirmed victims whose decision is public, fewer than one in ten now say they paid, down from nearly three in ten in 2018. The full breakdown by year, sector, country and group is in the ransomware payment rate analysis.

Why ransomware is not going away

Law enforcement has scored real wins, from the Hive infiltration to the takedown of LockBit in Operation Cronos, but the underlying conditions remain. Edge devices keep shipping with vulnerabilities. Credentials keep being stolen and resold. Cryptocurrency keeps providing a payment rail. And the asymmetry is brutal: a defender has to be right every day across a sprawling estate, while an attacker needs one foothold and a long weekend.

What has changed is the economics. With fewer victims paying, operators have moved toward stealing data and selling it directly, and the brand that dominated a year ago is rarely the one that dominates today. The live picture, which groups are active, how many victims they claim and which claims are confirmed, is on the Ransomtracker and in the threat group profiles.

How to protect against ransomware

The playbook is well understood, and most of it is operational discipline rather than product. Phishing-resistant multi-factor authentication on every external service closes the front door that most intrusions walk through. Prompt patching of internet-facing systems, especially VPNs and firewalls, closes the second. Modern endpoint detection with credential-theft protection makes privilege escalation noisy. Immutable, offline, regularly tested backups make encryption survivable. Network egress monitoring catches the data theft that precedes it. And a rehearsed incident-response plan turns a ransom note into a manageable, if miserable, week rather than an existential crisis. Our incident response runbook and ransomware-resistant backup guide go into each of these in detail.

Frequently asked questions

Sources and further reading

• Ransomware statistics: confirmed attacks by month and the confirmed attacks index by sector, country and year, the dataset behind the figures in this guide.
• Ransomware payment rate, 2018 to 2026: how the disclosed payment rate fell below one in ten.
• How ransomware works: the full attack lifecycle, double extortion explained and what RaaS is.
• A brief history of ransomware, from the 1989 AIDS Trojan to the RaaS era.
• CISA, StopRansomware: US government guidance, advisories and the #StopRansomware guide.
• Europol and partners, No More Ransom: free decryption tools where they exist.