Ransomware Explained: What It Is, How It Spreads, and How to Stay Protected

Quick answer: Ransomware is malware that locks your files (and often steals a copy) until you pay. The FBI does not support paying, because payment doesn’t guarantee you get your data back. The best protection is a backup that ransomware can’t reach, plus updates, multi-factor authentication, and caution with email links and attachments. If you’re hit, disconnect from the network, don’t pay, check for a free decryptor, and report it at ic3.gov.

Ransomware sounds like a problem for hospitals and big companies, and they are frequent targets. But individuals and families get hit too, usually through an email, a bad download, or an unpatched device. Here is how it works, what a real case teaches, and exactly what to do before and after an attack.

A Real Example: The FBI’s LockBit Decryption Keys

LockBit was one of the most active ransomware groups. In June 2024, FBI Cyber Division Assistant Director Bryan Vorndran said the FBI was holding more than 7,000 LockBit decryption keys, and urged past victims to come forward. LockBit had been used in over 2,400 attacks worldwide, more than 1,800 of them in the United States, according to the FBI. Victims could be helped only if they reported: the FBI pointed them to the Internet Crime Complaint Center (IC3) and a dedicated page, lockbitvictims.ic3.gov.

Two lessons stand out. First, many victims never reported, so help was waiting that they didn’t know about. Second, the FBI said the group kept victim data even after ransoms were paid, so paying didn’t make the problem go away. FBI, “FBI Cyber Lead Urges Potential LockBit Victims to Contact Internet Crime Complaint Center” (June 2024).

What Ransomware Is

CISA describes ransomware as malware designed to encrypt files on a device, “rendering any files and the systems that rely on them unusable.” Attackers then demand money to unlock them. Many also steal data first and threaten to sell or leak it if the ransom isn’t paid. This is often called double extortion, and it means that even restoring from backup may not end the threat. Sources: CISA, Ransomware 101.

How It Spreads

The FBI says ransomware can arrive through an email attachment, an ad, a link, or a website. In practice that means:

Phishing emails and texts with a malicious attachment or link. See 5 quick ways to spot a phishing email.
Malicious downloads and ads, including pirated software.
Unpatched devices, where a known flaw lets malware in.
Stolen or weak logins, which is why multi-factor authentication matters.

Source: FBI, Ransomware.

How Common Is It?

The FBI’s 2025 Internet Crime Report logged 3,611 ransomware complaints and $32,320,105 in reported losses. Treat those as a floor: they cover only what victims reported, and the report doesn’t say how many people paid. The groups most often named were Akira, Qilin, INC./Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SAFEPAY, and Medusa. The most affected sectors were critical manufacturing, healthcare and public health, and government facilities. Source: FBI IC3, 2025 Internet Crime Report.

Types You’ll Hear About

Type	What it does
Encrypting ransomware	Scrambles your files so you can’t open them
Locker ransomware	Locks you out of the device or screen
Double extortion	Encrypts files and threatens to leak stolen data

These categories are our shorthand; the sources above describe the behavior, not these labels.

Warning Signs

Files that suddenly won’t open, or have strange new extensions
A ransom note or a screen demanding payment
A device that slows sharply or won’t start normally
Unexpected activity on accounts right before or after

If you see any of these, act quickly using the steps below.

How to Protect Yourself

The FBI recommends keeping systems updated, using auto-updating antivirus, and making frequent backups that are kept disconnected from your computer. The IC3 report adds encrypted, immutable offline or off-site backups, multi-factor authentication, patching, and limiting access to what each account needs. For a household:

Back up files in two places. Use one cloud copy and one external drive that you unplug after backing up. A drive that stays connected can be encrypted along with everything else.
Test a restore. Open a file from the backup to make sure it works.
Turn on automatic updates for your phone, computer, browser, and apps.
Use a unique password and multi-factor authentication on email and cloud accounts. A password manager makes this practical.
Run reputable security software. See our antivirus guide.
Be skeptical of unexpected links and attachments, even from people you know. See social engineering.
Secure your home network and smart devices. See secure Wi-Fi in minutes and our smart home security guide.

If You’re Hit: What to Do

Disconnect. Unplug the network cable, turn off Wi-Fi, and disconnect external drives so it can’t spread or reach backups. CISA’s checklist says to power a device down only if you can’t disconnect it.
Don’t pay. The FBI says it does not support paying a ransom, and that paying doesn’t guarantee you’ll get any data back. Paying can also mark you as a target for repeat attacks.
Don’t delete anything yet. Keep the ransom note and take photos of the screen. They help investigators and decryptor tools.
Check for a free decryptor. The No More Ransom project, backed by Europol and Dutch police, offers free decryptors and says you “should never pay.” Not every ransomware has a decryptor, so check first. No More Ransom.
Report it. File at ic3.gov or contact your local FBI field office. The LockBit case shows why: the FBI could only help victims who came forward.
Restore from a clean backup after the device has been wiped or cleaned. Change passwords from a different, clean device, starting with email and financial accounts.
Watch for data misuse. If data may have been stolen, treat it like a data breach: monitor accounts and consider a credit freeze.

CISA’s Ransomware Response Checklist is written for organizations (it covers incident response teams, system images, and stakeholders), but its first moves, isolate and preserve evidence, apply at home too. If the infected device is for work, tell your employer’s IT team immediately.

Ransomware and Families

Kids and teens often download games, mods, and free apps, which is a common path to malware. Set up supervised accounts, limit who can install software, and talk about what to do if a strange message appears. See our guides to choosing a first smartphone and social media safety for parents.