Ransomware encrypts your files and demands payment for the key. It's the one threat that specifically defeats the backup arrangement most people have, because it reaches everything your computer can reach — including your synced cloud folder and the external drive you left plugged in.
The protection isn't complicated. It's mostly one habit.
How it actually reaches you
For individuals and small businesses, the common routes are:
Email attachments and links. A document that asks you to enable content, an invoice that isn't one, a delivery notice with a link. Still the most common entry point.
Compromised credentials on remote access. Any service exposed to the internet with a weak or reused password — remote desktop in particular.
Software vulnerabilities. Unpatched operating systems, browsers, plugins, and network devices.
Malicious downloads. Pirated software, fake installers, browser extensions, cracked applications. Cracked software is a notably reliable delivery mechanism because the victim expects to have to bypass their own security warnings.
Someone else's compromise. A supplier, a contractor, a service you use.
Why your current setup probably doesn't protect you
Cloud sync doesn't help. When ransomware encrypts your files, your sync client sees thousands of modified files and dutifully uploads all of them. Within minutes the encrypted versions are on the server and on every other device. This is the sync engine working exactly as designed.
Some services offer version history and mass restore, which can genuinely save you — but the capability varies by provider and plan, and restoring hundreds of thousands of files through a web interface is not a quick afternoon.
A permanently connected backup drive doesn't help. If your computer can write to it, so can ransomware. Modern variants specifically look for attached drives and network shares.
A NAS on your network may not help. Network storage that your computer has write access to is reachable. Snapshot features on some network drives are genuinely effective, and standard shared folders are not.
Antivirus helps and isn't sufficient. It catches known threats. New variants exist specifically because they aren't caught yet.
The protection that works: an offline copy
One backup copy that is physically disconnected most of the time.
That's it. That's the core of it. A drive sitting in a drawer cannot be encrypted by software, because software cannot reach it.
The routine:
- Plug in the backup drive
- Let the backup run
- Unplug it
- Repeat weekly
Four steps, five minutes of attention a week, and it defeats the entire category. This is the least technical and most effective measure available.
Two drives rotated is better than one — plug in drive A this week, drive B next week, keep one off-site. If an infection happens between backups and you don't notice for days, the older drive is still clean.
Immutable and versioned backups
The alternative to physical disconnection is storage that can't be overwritten even by something with access.
Cloud backup services with retention. Backup services (as distinct from storage services) typically keep deleted and previous file versions for extended periods, and store them in a way the client machine can't rewrite. If ransomware encrypts your files, the service has yesterday's versions. This is the strongest hands-off protection available.
Object storage with object lock. Storage configured so files cannot be modified or deleted for a defined period, even by someone with the credentials. Standard in business setups, increasingly available to smaller users.
Snapshot-capable network storage. Some NAS devices take read-only snapshots that can't be altered from the network. Excellent when configured correctly, and it needs to be configured deliberately — it isn't the default.
The prevention layer
Backups are how you survive it. These are how you reduce the chance of it happening:
Keep everything updated. Operating system, browser, applications, and network hardware. Most successful attacks use known vulnerabilities with available patches.
Don't run as an administrator day to day. A standard user account limits what malware can do. Minor inconvenience, real reduction in blast radius.
Be careful with attachments and links. Particularly documents asking you to enable macros or enable content. That prompt exists to bypass a security measure, and legitimate documents rarely need it.
Strong unique passwords, and two-factor authentication, especially on anything with remote access.
Don't expose remote desktop to the internet. If you need remote access, put it behind a VPN.
Avoid cracked software. The economics of distributing malware in pirated applications are excellent, and the practice is widespread.
Keep antivirus on and updated. It's not sufficient, and it does catch a lot.
If it's happening right now
1. Disconnect immediately. Unplug the network cable, turn off Wi-Fi. This stops encryption of network locations and stops the sync client uploading encrypted files.
2. Do not plug in your backup drive. Not to check, not to save something. The infection is active.
3. Power off the affected machine if encryption appears to still be in progress. This is one of the few situations where pulling the plug is better than a clean shutdown — every second of running is more files encrypted.
4. Disconnect other devices from the network if they share storage.
5. Assess the scope. From a different, clean device: what's encrypted, what's reachable, what shares access.
6. Check your cloud service's version history. Many services can restore to a point before the encryption. Do this from a clean device.
7. Report it. In many countries there are national cybercrime reporting routes. For a business, this may be a legal requirement, particularly if personal data is involved.
Should you pay?
Law enforcement guidance in most countries is: don't.
Payment doesn't guarantee recovery. A meaningful proportion of victims who pay don't get usable data back.
It marks you as a payer, which invites repeat targeting.
It funds the industry.
It may be illegal, depending on your jurisdiction and who the recipient is, where sanctions apply.
That said, the guidance is easier to follow when you have backups. A business facing existential loss with no backup makes this decision under real pressure, and that's the situation the rest of this article exists to prevent.
Before considering payment, check whether a free decryption tool exists for the variant. Security organizations and law enforcement collaborations publish decryptors for many families where keys have been seized or flaws found. It's always worth checking.
Recovering properly
1. Don't restore onto the infected machine. Wipe it completely and reinstall the operating system. Trying to clean an infected system leaves you uncertain whether it's clean.
2. Change your passwords from a clean device. Assume anything stored or typed on the infected machine is compromised.
3. Restore from a backup you're confident predates the infection. Ransomware often sits dormant for a period before triggering, so the most recent backup may already contain it. If you have multiple restore points, consider going back further.
4. Scan restored files before reconnecting to the network.
5. Reconnect and rebuild gradually, not all at once.
6. Find the entry point. Restoring without understanding how it got in means it can happen again.
The realistic minimum
If you do three things:
- Keep one backup copy disconnected, plugged in weekly and unplugged after.
- Use a cloud backup service with version retention — not just cloud sync.
- Keep everything patched and don't run as administrator.
The first one alone puts you ahead of most home and small business setups, and it costs nothing but the habit.
Next in this series: Password Managers: How to Set One Up and Actually Use It