Glossary
Ransomware
In one sentence
Ransomware is malicious software that locks or encrypts your files and systems, and often steals copies of your data, so criminals can demand payment to restore access or keep quiet.
A ransomware attack usually starts quietly: a phishing email, a stolen password for remote access, or an unpatched system. The attackers then look around your network, try to disable or delete backups, copy out sensitive data, and finally encrypt everything they can reach at once — often overnight or on a weekend. Then comes the ransom note.
Most modern attacks are “double extortion”: even if you can restore from backups, the criminals threaten to publish the data they stole. CISA and the FBI advise against paying, because payment doesn't guarantee your data back or that stolen copies get deleted, and it funds the next attack.
Why it matters for a practice: HHS guidance says that when ransomware encrypts ePHI, it's presumed to be a reportable breach unless you can demonstrate a low probability that the information was compromised. And beyond compliance, it stops patient care — no schedules, no charts, no imaging, no claims.
Protection comes in layers: MFA on email and remote access, EDR on every device, prompt patch management, least privilege so one account can't reach everything, and — most importantly — immutable backups kept separate from your network, with restores tested regularly.
Example: a small accounting firm's file server is encrypted on a Saturday night during tax season. Because backups were stored in an immutable cloud copy the attackers couldn't delete, the firm restores client files by Monday. The incident response plan then guides the harder questions: what was stolen, and who has to be notified.
Our ransomware protection guide covers each layer in detail.
Related terms
- PhishingPhishing is a scam message — usually an email, but also texts and phone calls — designed to trick someone into handing over a password, opening malware or sending money.
- EDR (endpoint detection and response)EDR is security software on each computer that watches for suspicious behavior, records what happens, and lets defenders stop and isolate an attack in progress.
- Immutable backupA backup copy that can’t be changed or deleted — by anyone, including an attacker with admin rights — until a set retention period ends.
- 3-2-1 backup ruleKeep three copies of your data, on two different kinds of storage, with one copy kept off site.
- Incident response planA written, step-by-step plan for what your business does when a security incident happens — who to call, what to shut off and what to record.
- Patch managementPatch management is the ongoing process of installing security updates on operating systems, applications and devices — on a schedule, with tracking, so nothing is left unprotected.