Digital kidnapping
Ransomware is exactly what it sounds like: malware that takes your files hostage and demands money for their return. A victim opens one bad email attachment, and hours later every document, photo and database on their network is locked behind encryption only the criminals can undo. The ransom note appears on screen, demanding payment — usually in cryptocurrency — for the decryption key. It is not a niche problem. In August 2026, security researchers documented 997 ransomware attacks in a single month — a new all-time record, averaging 32 attacks a day. And it is no longer just a nuisance for home users: hospitals, schools, utilities and entire city governments have been shut down by it.
A brief history: from floppy disks to billion-dollar gangs
- 1989: The first ransomware, the AIDS Trojan, was mailed on 20,000 floppy disks to attendees of a WHO AIDS conference by biologist Joseph Popp. It hid victims' file directories and demanded payment to a Panama post office box. Crude — but it established the extortion model still used today.
- 2017: WannaCry spread to more than 150 countries in days, crippling the UK's NHS and thousands of organisations worldwide.
- 2024: The ALPHV/BlackCat gang's attack on Change Healthcare affected an estimated 100 million people — one of the largest health-data breaches in US history. A reported $22 million ransom was paid, yet the stolen data resurfaced when a second group tried to extort victims with the same data. The pattern across decades is the same. What changed is the scale — and the business model.
How an attack unfolds, step by step
A modern ransomware attack is rarely a single program. It is a campaign, run by humans, following a predictable playbook:
- Initial access. Attackers get in through a phishing email, a stolen password, or an unpatched vulnerability in software exposed to the internet. They may even buy access from specialist brokers who sell pre-hacked networks.
- Privilege escalation and lateral movement. Once inside, they quietly move from computer to computer, stealing admin credentials and mapping the network to find the most valuable data — file servers, databases, backups.
- Data exfiltration. Before touching anything, they copy the sensitive material out: financial records, customer data, contracts, source code. This happens days before the victim notices anything.
- Encryption. The attackers deploy the encryptor across as many systems as possible, deliberately stopping backup services and deleting recovery snapshots so victims can't simply restore. The ransom note appears.
- The demand and negotiation. The gang posts a sample of the stolen data on its leak site to prove the breach, sets a payment deadline, and negotiates through encrypted chat channels.
- The leak. If the victim refuses to pay, the stolen data is published on a dark-web leak site for anyone to download. In the second quarter of 2026 alone, more than 2,100 organisations were listed on leak sites. The whole intrusion can take days — but the fastest attackers now go from first access to data theft in as little as 72 minutes.
Ransomware-as-a-service: crime as a subscription
One reason attacks keep climbing is that you no longer need to be a hacker to launch one. Ransomware-as-a-service (RaaS) lets criminal "affiliates" rent ready-made ransomware from developer gangs, splitting the profits. It works like a grim mirror of the legitimate software industry — complete with customer support, affiliate programmes and marketing. The most active groups in 2026 include Qilin, which claimed 157 victims in August alone. This industrialisation is why attacks hit a record high: the tools are cheap, the playbook is proven, and the targets haven't closed the gaps it exploits.
Double extortion: why backups are no longer enough
The biggest shift in recent years is the double extortion model. Attackers steal your data before encrypting it — so even if you have perfect backups and never need the decryption key, they can still threaten to publish your stolen files. The numbers tell the story:
- 77% of ransomware intrusions in 2025 involved confirmed data theft, up from 57% in 2024.
- 70% of 2026 ransomware insurance claims involved both encryption and data theft together.
- The average initial ransom demand now exceeds $1 million — up 47% in a year — partly because attackers price demands on the volume of stolen data.
- Some groups have gone further, skipping encryption entirely and relying on pure extortion: pay, or we leak. The good news: 86% of businesses refused to pay in 2026, a sign that better backups and firm "don't pay" guidance are working — even as demands get bigger.
The four types of ransomware, compared
| Type | How it works | Example pressure |
|---|---|---|
| Encrypting ransomware | Scrambles your files; sells the decryption key | "Pay or lose your data" |
| Locker ransomware | Locks you out of the whole device | "Pay to use your computer again" |
| Double extortion | Steals data first, then encrypts it | "Pay twice — for the key and our silence" |
| Pure extortion | No encryption at all — just the threat to leak | "Pay or your secrets go public" |
How to protect yourself
For individuals and small organisations, the basics still defeat most attacks:
- Keep offline backups — and test that they restore. A backup the attackers can also encrypt is no backup. Follow the 3-2-1 rule: three copies, on two different types of media, one offline.
- Patch quickly. Attackers love old, unpatched software. Automatic updates are your friend.
- Use multi-factor authentication everywhere that matters, especially email and remote access.
- Treat unexpected attachments and links as guilty until proven innocent. Phishing remains the top way in.
- Segment your network. If one machine gets hit, it shouldn't be able to reach everything else. And one more rule worth knowing: back up the things you'd cry over losing — photos, documents, work files — before you need to.
Takeaway checklist
- What it is: malware that locks your files and demands payment — now usually combined with stealing your data first (double extortion).
- How it spreads: phishing emails, stolen credentials, and unpatched software are the top entry points.
- The business: ransomware-as-a-service lets low-skill criminals rent professional attack tools, which is why attacks hit a record 997 in August 2026.
- The scary part: attackers copy your data before encrypting it, so backups alone don't end the threat — 77% of 2025 intrusions involved data theft.
- The hopeful part: average demands exceed $1 million, but 86% of businesses refused to pay in 2026.
- Your defence: offline backups, fast patching, multi-factor authentication, and healthy scepticism about unexpected attachments. Related reading: Cybersecurity Basics Everyone Should Know · Passkeys Explained: The End of Passwords?
