What is ransomware? How to prepare and respond
Understand ransomware, data extortion, tested backups, and the first steps to coordinate an incident response.
Ransomware is a type of malicious software, or malware, used to deny access to systems or data while an attacker demands payment. It commonly encrypts files so the owner cannot use them, although not every incident follows the same pattern. [CISA's ransomware guidance](https://www.cisa.gov/sites/default/files/2023-08/cisa_ransomware.pdf) describes the loss of access and the limits of payment.
## Ransomware and data extortion
Attackers may also copy data and threaten to publish it. When file encryption and a threat to disclose stolen data are combined, this is often called double extortion. Data extortion can also occur without ransomware or encryption; do not assume that restoring files removes the risk of disclosure. The [CISA and partners' StopRansomware Guide](https://www.cisa.gov/sites/default/files/2023-06/stopransomware_guide_508c_0.pdf) distinguishes these patterns.
For example, an organization finds that a shared file server is encrypted and receives a demand. Its response team isolates affected systems according to its plan, engages incident responders, and checks whether information may have been copied. The team does not know whether data was stolen merely because a demand claims it was; investigation is needed.
## Prepare before an incident
Maintain backups of important data and configuration, keep copies isolated from ordinary production access, and regularly test restoring them. A backup is a separate copy that can support recovery; its existence alone does not prove that it is complete, clean, current, or restorable. Restrict administrative access, apply security updates, and rehearse an incident response and business continuity plan. [CISA's guidance](https://www.cisa.gov/sites/default/files/2023-06/stopransomware_guide_508c_0.pdf) discusses offline backups and recovery testing.
## Respond and preserve evidence
Activate the incident response plan and involve the people authorized to manage security, legal and business decisions. Containment limits further damage, for example by isolating affected systems under the response team's direction. Protect backup systems, preserve relevant logs and records, and document the timeline. Avoid wiping systems, changing evidence, or reconnecting affected devices before the response team has considered investigation and recovery needs.
Investigate the entry point, scope, affected accounts and possible data exposure. Contact the appropriate incident response provider and, where applicable, law enforcement or other required authorities through independently verified channels. Reporting and notification obligations vary by situation; obtain advice appropriate to the affected organization.
## Recover carefully
After the response team has contained the incident and assessed the environment, restore from verified backups or rebuild systems using known-good sources. Check that access and the original entry point are addressed before reconnecting services, then monitor for signs of renewed access. Recovery includes validating the restored service and its data, not simply restarting a machine.
Paying a demand does not guarantee a working decryption method, recovery of every file, or deletion of copied data. The [CISA guidance](https://www.cisa.gov/sites/default/files/2023-08/cisa_ransomware.pdf) describes that uncertainty. This article provides general information and does not promise detection, decryption, or recovery. For related guidance, see [Mithril's phishing guide](https://blog.mithril.fund/what-is-phishing-spear-phishing?lang=en) and [incident response guide](https://blog.mithril.fund/cyber-incident-response-by-country?lang=en). Sources reviewed on 2026-10-29.