Ransomware

A program that locks every file on a company's computers and demands a payment to give them back.

Also known as extortion malware file locking virus crypto locker

Definition

Ransomware is a program that locks your files and asks for money to give them back. You arrive in the morning, open the folder you use every day, and every file has a strange new ending. A note on the screen gives a price and a deadline. The invoices, the customer list, three years of work, all still there and none of it readable.

The ransom is the number everyone talks about. It is rarely the biggest one. The real cost is the days the business stands still. A clinic that cannot see today's appointments sends patients home. A shop that cannot price an item stops selling. Staff are paid for a week of waiting, orders are cancelled, and every phone call explaining the delay does its own quiet damage. That is what closes small companies, not the payment.

Paying is a poor bet as well. You are trusting a criminal to keep a promise. Some send a key that works. Some send a key that opens part of the files and ruins the rest. Some take the money and send nothing, or come back three months later because they now know you pay. The key also does not close the hole they came in through. In several countries the payment itself is a legal problem.

One thing saves you, and it is dull. A backup the infection cannot reach. If the backup drive is plugged into the same computer, or the same login can delete it, it gets locked along with everything else. What you want is a copy kept off your network, or one that nobody is allowed to delete for a set number of days. Then you restore, and a closed month becomes a bad afternoon. That is why Hostrena keeps server copies away from the live machine.

Test it. A backup nobody has ever restored is a hope, not a backup. Ask for one real file back today and time how long it takes. When Linkysoft is called on the first morning of an attack, the first question is never about the ransom, it is how long the business can run on paper. A cybersecurity review from Linkysoft usually starts with a restore test before anything else is discussed. It is the least interesting hour of the work, and the one that decides how the worst week ends.

Questions about Ransomware

Should we pay the ransom?
Almost never as a first move. The payment is a promise from a criminal, it does not close the way they came in, and in several countries it brings legal trouble. Check your backups and call for help first.
How does ransomware get into a company?
Usually through an email attachment, a password reused from another website, or a remote access door left open to the internet. Rarely anything more exotic than that.
What is the first thing to do when files start locking?
Take the affected computers off the network at once, then call for help. Do not delete anything and do not start reinstalling, because the traces left behind show how they got in.
Does a backup on an external drive protect us?
Only if the drive is unplugged and put away once the copy is finished. A drive left connected is locked along with everything else, and most companies learn that on the worst possible morning.
How long does a company take to get back to work?
With a backup that has been tested, often a day or two. Without one, two to four weeks is common, and some files never come back at all.

Still not sure how this applies to your project?

Tell us what you are building and we will answer in plain language.