Ransomware: how to protect yourself and what to do if you're hit

In 2025, 45% of organisations that paid a ransomware ransom didn't recover all their data — and even so the number of victims keeps growing. The average time between initial access and full encryption of the files has fallen to under 24 hours, according to Securelist. That means by the time you notice the attack, it's usually too late to react without prior preparation.

The good news: the defences that work are simple, cheap (sometimes free) and can be put in place today.

How ransomware gets into a system

Understanding the entry vector is the first step to blocking the attack. The three most common in 2025-2026:

• Email phishing: a malicious attachment (PDF, Word with a macro, ZIP containing an executable) or a link to a fake download page. The attacker needs no advanced technique — a convincing message about an invoice, a delivery tracking update or a fine is enough.
• Exposed RDP: port 3389 reachable directly from the internet, with a weak or reused password, is the favourite vector of groups like LockBit and BlackCat. Tools like Shodan index those ports publicly — any criminal can find them in seconds.
• Unpatched vulnerabilities: WannaCry exploited EternalBlue weeks after Microsoft had released the MS17-010 patch. Anyone who hadn't updated was swept away. The pattern repeats every year with critical CVEs that go unfixed for months.

Credentials stolen in earlier breaches are also used for initial access via credential stuffing — one more reason never to reuse a password across services.

The 3-2-1 rule: backup is the only foolproof defence

Ransomware encrypts files. If you have an intact, reachable copy, the attack becomes a downtime incident — annoying, but manageable. Without a backup, the options are pay or lose everything.

The 3-2-1 rule is the minimum standard:

• 3 copies of your data (the original + 2 backups)
• 2 different media (e.g. external drive + cloud)
• 1 copy offsite (cloud or a separate physical address)

The problem: according to Veeam, 93% of ransomware attacks try to compromise or destroy the backup repositories. The answer is the expanded version, called 3-2-1-1-0:

• Add 1 offline or immutable copy — an external drive disconnected after the backup, or cloud storage with deletion protection (S3 Object Lock, for example).
• 0 errors on restores: test the restore at least quarterly. An untested backup is lost data with extra steps.

Critical detail: unplug the external drive from the power socket and from the computer after every backup. Ransomware running while the disk is connected encrypts the backup along with the original files.

5 preventive measures that eliminate most of the risk

• Keep everything updated. Windows Update, drivers, router firmware, browser plugins. Most ransomware exploits holes that have already been patched — updating is closing open doors.
• Disable RDP if you don't need it. If you do need it, put it behind a VPN and restrict it by source IP. Port 3389 exposed on the internet without protection is the equivalent of leaving the key in the lock.
• Enable MFA on every critical account. Corporate email, VPN, hosting panel, cloud backup service. Even if the password leaks, the second factor blocks the login.
• Be suspicious of email attachments and links. Dangerous extensions: .docm, .xlsm, .js, .vbs, .exe inside a ZIP. Manufactured urgency ("your account will be blocked in 24h") is the most-used trigger in phishing campaigns.
• Turn on Controlled Folder Access in Windows 11. This feature blocks unauthorised applications from writing to protected folders (Documents, Desktop, Pictures). It doesn't prevent infection, but it interrupts the encryption phase of a good share of ransomware families.

To configure Controlled Folder Access and other built-in protections: A safer Windows 11: 10 settings to turn on today.

During the attack: every minute counts

What should you do the moment you spot ransomware on a computer?

Isolate the machine from the network immediately: unplug the network cable and turn off Wi-Fi. Ransomware spreads laterally — one compromised node can encrypt entire network shares in minutes. After that, don't reboot the computer (memory dumps can contain decryption keys that researchers are able to extract) and document the ransom note before taking any other action.

In the following steps:

• Identify the ransomware family from the extension on the encrypted files or from the name of the ransom note (usually .txt or .html on the desktop).
• Go to nomoreransom.org — a Europol project with free decryption tools for dozens of families. Some groups have had their keys compromised by security researchers.
• File a police report (required by some insurers and useful for the investigation).
• If you have an IT team or a support contract, call them in at this point — not after you've tried to fix it alone.

Paying the ransom: the numbers you need to know

The decision to pay looks simple when you're staring at locked data, but the numbers point to a trap. In 2025-2026, 45% of organisations that paid the ransom did not recover all their files. On top of that, companies that pay tend to be targeted again — they've become confirmed payers on the criminal groups' radar.

Paying also funds those groups' infrastructure and encourages new attacks against other victims. From a legal standpoint, in some sectors (healthcare, financial, critical infrastructure), paying sanctioned groups can amount to a compliance violation.

The real alternative is a tested, up-to-date backup. Anyone with a working restore doesn't have to negotiate with any criminal.

The pattern has been repeating for decades

WannaCry in 2017 infected 200,000 systems in 150 countries in under a day — using an NSA exploit against unpatched machines. Almost ten years later the vector has changed (today it's far more targeted phishing and RDP than a self-propagating worm), but the logic remains the same: outdated systems, weak credentials and missing backups are the three ingredients that turn an attack into a catastrophe.

Tested offline backup + updated system + MFA enabled. Those three pillars eliminate most of the risk. For anyone who wants to close the rest, the next step is securing your home router — an entry point few people configure properly, and the side door none of the measures above covers.