Ransomware is malicious software that blocks access to files or systems and demands payment from its victim.
When files become leverage
Ransomware commonly encrypts data or systems and presents a demand for payment. An incident can interrupt operations even when a victim refuses to pay.
Recovery starts before the incident
Offline or isolated backups, tested restoration, least privilege, patching, and network segmentation limit impact. A response plan should also cover evidence, communication, and legal obligations.