What Is Ransomware, and How Does It Actually Get In?

Short answer: Ransomware gets in through an email attachment, a weak remote-access login, or unpatched software, then locks your files until you pay. It's survivable if you keep a backup that's genuinely disconnected from your network, since a connected backup gets encrypted along with everything else.

Ransomware doesn't announce itself. There's no dramatic warning, no alarm going off — just a normal morning until every file on the network suddenly won't open, and a note on the screen explains why: everything's been encrypted, and getting it back costs money, paid on a deadline, usually in cryptocurrency.

What's actually happening

Ransomware is software that locks your files by encrypting them, then holds the key to unlock them for ransom. The part that surprises people is how ordinary the way in usually is — it's rarely a dramatic break-in. The three most common doors are the same ones behind most security problems:

• An email attachment or link — the exact mechanism phishing uses, except what runs is malicious software instead of a fake login page.
• A weak or exposed remote-access login — a tool used to connect to office computers remotely, left reachable from the internet with a guessable or reused password.
• Outdated software with a known, unpatched flaw — often a fix has existed for months; the infection just found a system that hadn't installed it yet.

Once it's in, it usually doesn't strike immediately. It often spreads quietly first — to other connected computers, shared drives, and anything else reachable on the same network — before triggering the encryption everywhere at once. Increasingly, it also steals a copy of the data before locking it, so the threat isn't just "pay to get your files back" — it's also "pay, or we publish what we took." That combination is usually called double extortion.

A local business scenario

(A composite, illustrative pattern — not one specific business's story.)

An office manager at a small accounting firm opens what looks like a client's invoice attached to an email — a name and format they've seen a hundred times before. Nothing visibly happens. Friday afternoon passes normally.

Monday morning, nobody can open anything. Every client file, every spreadsheet, every document on the shared office drive shows the same broken-file icon, and a text file sitting on every desktop explains why: pay within 72 hours, in cryptocurrency, or the price doubles — and a second line adds that copies of client files were already taken, and will be published if the deadline passes. The firm's backup drive, plugged into the same network the whole time, was encrypted right along with everything else. There's no clean copy to restore from at all.

Why it works

Ransomware's entire leverage comes from one fact: the business has no other way to get its files back. That's what makes the backup question the whole story — not whether backups exist, but whether they were ever actually reachable by whatever just spread through the network. A backup sitting on the same always-connected drive as everything else isn't really a backup in the way that matters here; it's just another folder for the same infection to reach.

The one habit that makes it survivable

Keep at least one backup copy genuinely disconnected from your main network — an external drive that's unplugged when not actively backing up, or a cloud backup service specifically designed to keep old versions safe from being overwritten by an infected sync. This is the industry's long-standing 3-2-1 rule: three copies of your data, on two different types of storage, with one copy kept offsite or offline. If ransomware can't reach a copy, it can't encrypt it — and a business with a clean backup can restore and move on, instead of facing a ransom deadline as the only way back to its own files.

Best practices

1. Keep at least one backup truly offline or disconnected, not just in another folder on the same always-connected network — and actually test that you can restore from it. A backup you've never tried restoring is a guess, not a plan.
2. Patch and update software promptly. Many ransomware infections start through a vulnerability that's been public and fixable for months, not a brand-new, unknown flaw.
3. Treat email attachments and links with the same hover-and-verify habit as phishing — ransomware very often arrives exactly that way.
4. If you use remote access to your systems, protect it directly: enable multi-factor authentication on it, and don't leave it reachable from the open internet without protection.
5. Don't treat "pay the ransom" as the plan. Paying doesn't guarantee you get working files back, and it doesn't undo data that was already stolen for double extortion. Prevention and a tested backup are the actual plan — decide who you'd call and what you'd do before a deadline is already counting down, not during one.

Helpful, free resources

• CISA's #StopRansomware Guide — the U.S. government's official, free prevention and response guide.
• No More Ransom — a free project backed by Europol and industry partners offering decryption tools for some ransomware strains, if you're already hit. Worth checking before paying anything.

A note on what this is and isn't: this post is general security education, not a personalized risk assessment of your specific business or systems. If you want a free, automated starting point for your own site, we offer a Security Health Check — free for any business, no obligation.