ransomware

basicwidespread

A malicious program that renders your files or entire machine unusable via encryption or locking, and demands a ransom for unlocking.

In plain terms

Imagine you come home and someone has replaced all the locks in your apartment. A note hangs on the door: pay, and you get the new key. Ransomware does the same with your data: your photos, documents, and company records are there, but you cannot open them.

Attackers usually aim for money, not destruction. Ransom is typically demanded in cryptocurrency because it allows fast, cross-border, and anonymous payment. Nowadays, they often copy the data as well and threaten to make it public if you do not pay.

Most malware tries to remain hidden. Ransomware also works quietly for a while, but at the end openly states that you have been attacked and states the price.

AI has appeared on both sides. Attackers use it to generate scam emails with flawless Hungarian, while defenders use it to filter suspicious behavior.

How it works

Entry: the malware most commonly enters via a fraudulent email attachment, a fake link, a stolen password, poorly protected remote access (such as via VPN), or a security flaw in an unupdated program.
Expansion: on a corporate network, attackers quietly explore the system, seize as many machines as possible, and try to access backups. This sometimes lasts only hours, other times days or weeks.
Data theft: sensitive data is often copied before encryption, so the attackers can also extort victims by threatening to leak it later.
Encryption: the program locks files with strong encryption, and the key needed to unlock them is held only by the attackers.
Ransom demand: a message demanding ransom appears with the amount, deadline, and payment method, often accompanied by a 'customer service' chat window.

An everyday example

On Monday morning, files do not open on any computer in the accounting office, and an English message on the screen states that payment is required within 72 hours. It turns out that on Friday, someone opened an email attachment disguised as an invoice. The office can restart within a few days because it had a fresh backup disconnected from the network.

Who is affected

everyoneA single bad click can lose years of family photos and documents if you have no separate backup.

entrepreneur, executiveAn attack can paralyze a company for days or weeks. If personal data is involved, it must be reported as a data protection incident, and you may face a fine.

employeeMany attacks start through a colleague's email account or stolen password, so your vigilance is part of the defense. → Work & HR

patient, doctorHospitals are frequent targets, and a shutdown can delay surgeries and examinations, while findings may become inaccessible. → Health

A common misconception

MythIf I pay the ransom, I will get my data back, and the matter is over.

In realityPayment guarantees nothing: the key may be faulty, stolen data may be leaked later, and those who pay are often attacked again. Authorities therefore generally advise against paying.

Limits and risks

Antivirus is not enough: most protection comes from regular backups, which are not continuously connected to your machine or network.
Syncing cloud storage is not a backup, because encrypted files may also be copied to the cloud if there is no prior version to restore.
Encryption cannot usually be broken without a key. Free decryption tools exist only for certain, mainly older or incorrectly written versions, so it is worth checking the No More Ransom website to see if a solution exists for your case.
AI-written scam emails can no longer be identified by poor spelling, so treat unexpected attachments and urgent tones with suspicion.

Similar, but not the same

phishing – Phishing is a deceptive message used to trick you into revealing data or clicking; it is often just the gateway through which ransomware enters.
Spyware – Spyware secretly monitors and collects data, while ransomware openly locks your data and demands money.
data breach – In a data breach, data reaches unauthorized parties but remains with you; ransomware makes it inaccessible, and often the two occur together.

Related concepts

Broader

malware, cyberattack, cybersecurity, cybercrime

Narrower

double extortion, ransomware as a service, ransomware, screen lock

On the edge

phishing, backup, encryption, deception-based attack, two-factor authentication

A brief history

The first known ransomware was the 1989 AIDS Trojan, distributed via floppy disks through the mail. The phenomenon became widespread in 2013 with CryptoLocker. In 2017, WannaCry exploited a Windows security vulnerability to spread autonomously, infecting hundreds of thousands of computers worldwide within a few days.

Where things stand

By the end of 2026, ransomware is a major revenue source for organized cybercrime and also operates as a rental service. Victims have been paying less frequently in recent years. Attackers are therefore increasingly threatening to leak stolen data, and some are now extorting without encryption, using only data theft. AI and automated agents are increasingly used to write scam emails, identify targets, and execute specific steps of attacks.

Status: 2026 November

In the news

Appears in 6 Agent Age stories; the curve shows weekly occurrence in the news magazine.

3AM ransomware hits UK school estate in suspected AI-assisted attackNov 3, 2026 · Education & Family
Aurora ransomware operators used Cursor AI in attacks, reports sayAug 31, 2026 · Code
Russian-speaking hackers breach seven companies by tricking Cursor's AI agent into treating attacks as testsAug 27, 2026 · Code
Ransomware operator used Claude Code to strengthen attacks, report saysAug 18, 2026 · Code
Włocławek hospital to introduce AI in diagnostic imaging, with PLN 14.5m for digitisation and ransomware protectionAug 17, 2026 · Health
Ransomware attack hits Health Sciences Centre doors, ventilation and air conditioningAug 10, 2026 · Health

Also known as

ransomware · ransomware · ransomware · ransomware · ransomware · ransomware attack · crypto-ransomware · RaaS (ransomware-as-a-service)

Sources

This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.