Imagine switching on your computer and finding a full-screen message: "Your files have been encrypted. Pay within 48 hours or lose them forever." Your children's photos, work documents, invoices, your thesis: all still there, but impossible to open. It happens every day to individuals, freelancers and small businesses who thought it would never happen to them.

In this guide we look at what ransomware is, how it gets into computers, how to defend yourself in practice and what to do if you are hit.

What ransomware is

Ransomware is a type of malware that takes your data hostage. Once inside the computer, it encrypts your files with a key only the criminals know and then demands a ransom, usually in cryptocurrency, to give them back.

The latest versions go even further: before encrypting the files they copy them to the attackers' servers and threaten to publish them. This is known as double extortion, and it hits freelancers and businesses holding customer data especially hard.

How it gets into your computer

  • Emails that look legitimate: a fake invoice, a delivery notice, a document "to sign". The attachment or link starts the infection.
  • Compromised websites and malicious ads: sometimes simply visiting a page with outdated software is enough.
  • Pirated software and cracks: "free" software downloaded from unofficial sources is one of the favourite vehicles.
  • Fake updates: pop-ups asking you to update your browser or a video player.
  • USB sticks and external drives of unknown origin.
  • Poorly protected remote access: weak passwords on remote control programs or network devices.

Signs of an attack in progress

Ransomware works fast, but it sometimes leaves clues: the computer suddenly becomes extremely slow, fans spin at full speed for no reason, files change extension or icon, and text files with instructions appear in every folder. If you notice these signs, shut down the computer immediately and disconnect it from the network.

Why just any antivirus is not enough

Modern ransomware constantly changes shape to avoid being recognised by traditional signatures. Stopping it requires real-time behavioural analysis: the antivirus notices that a program is encrypting dozens of files per second and blocks it before the damage is complete. The best suites also offer protected folders that no unknown program can modify, and the ability to restore affected files.

Free antivirus products often lack these layers of defence, or offer them in a reduced form. Against ransomware, that is exactly where the battle is won or lost.

The most important defence: backups

No protection is one hundred percent perfect. That is why backups are the ultimate insurance: if you have a safe copy of your files, the blackmail loses all its power. The rule recommended by experts is called 3-2-1:

  • 3 copies of your important data;
  • 2 different media, for example your computer and an external drive;
  • 1 copy offsite or offline, such as a cloud service with version history or a drive you only connect during the backup.

Be careful: an external drive that is always connected to the PC can be encrypted along with everything else. Connect it, run the backup, then disconnect it.

Other rules that make a difference

  • Always update Windows, macOS, your browser and your programs: many attacks exploit flaws that have already been fixed.
  • Be wary of unexpected attachments, even if they seem to come from people you know.
  • Do not use pirated software: the apparent saving can cost you all your data.
  • Use a standard account for everyday use, not an administrator account.
  • Turn on folder protection: Windows has a feature called "Controlled folder access" in its security settings.

What to do if you are hit

  • Isolate the computer: unplug the network cable, turn off Wi-Fi and disconnect external drives and USB sticks.
  • Do not pay the ransom: there is no guarantee you will get your files back, and paying funds new attacks.
  • Photograph the ransom message: it will help identify the type of ransomware.
  • Look for a free decryptor: the international No More Ransom project collects free tools for some ransomware families.
  • Report the attack to the police or your national cybercrime authority.
  • Restore from backup only after the computer has been completely cleaned, ideally by reinstalling the system.
  • Change all your passwords from a safe device.

In short

Ransomware is one of the most devastating threats for anyone with important data on their computer, but defending yourself is possible: protection with behavioural analysis, disciplined backups and a few good habits reduce the risk dramatically.

Waiting to be hit is the most expensive mistake you can make. With our free quiz you can find out in one minute which protection keeps you safe, at the best price available.