Ransomware

Ransomware is malware that denies access to a computer or its data. Some ransomware locks the system so you cannot use it, while other ransomware encrypts your files so they cannot be opened. Many attacks do both, so a computer that looks locked may also have its files scrambled.

For example, a photographer's laptop holds the edited photos from a weekend wedding. On Monday every photo file has a different file extension and will not open, and a message on the screen says the files have been locked and gives instructions for making a payment.

The ransom demand

The attacker demands a payment before access is restored. Encrypted files normally cannot be recovered unless a backup exists, because the data has been scrambled and the attacker holds the key needed to unscramble it. Removing the ransomware from the computer does not usually bring the files back by itself.

Why paying is discouraged

Paying a ransom is discouraged because it funds criminal activity: the money supports the people who wrote and spread the ransomware and helps them pay for more attacks. Restoring your data from a backup is the reliable way to recover it, so a payment should not be treated as the normal solution.

Backups

A backup is a separate copy of your data, kept apart from the computer and its network so the ransomware cannot encrypt it too. If ransomware encrypts the files on your computer, you can restore them from the backup without paying the ransom. That is why backing up regularly is part of protecting data: a copy taken before the attack gives you a clean set of files to go back to.