Ransomware Protection and Recovery
Fact-checked on
Ransomware is malicious software used to deny access to systems or data, often with a payment demand. Criminals may also steal information and threaten to publish it.
Preparation matters because recovery is harder when the only backup is connected to the affected device.
What to Prepare
Keep tested backups and know who to contact for technical help. For a business, document responsibility for incident response and recovery.
Reduce the Risk
- Keep operating systems and applications updated.
- Protect accounts, limit unnecessary access and use strong authentication.
- Treat unexpected links and attachments cautiously, including messages apparently sent by familiar contacts.
- Keep a backup protected from changes made through the normal computer account. An offline copy can help protect against ransomware reaching the backup.
- Test restoration so you know the backup actually works.
If You Suspect an Attack
- Disconnect the affected device from networks, including Wi-Fi, to help limit spread.
- Contact your IT team or a competent incident-response professional promptly.
- Preserve the ransom message and relevant information for investigation.
- Assess the affected systems and any possible data theft before restoring from a known clean backup.
- Reconnect only after the cause has been addressed.
Warning: Paying does not guarantee recovery. Do not download a random “decryptor” or reconnect backup drives to an infected machine.
Tip: Recovery planning should cover stolen information as well as encrypted files.
