Home/Digital threats

Devices

Ransomware

Malware that locks your files and demands payment to unlock them.

What it is

Ransomware is malicious software that encrypts the files on your computer or phone — photos, documents, everything — and then displays a demand for money, usually in cryptocurrency, to restore them. Paying rarely guarantees you get your files back, and it funds more attacks.

How it happens

Most ransomware arrives through a booby-trapped email attachment, a pirated program, a fake software update, or a malicious ad. Once you run it, it quietly encrypts your files in the background before revealing itself. On home networks it can spread to other connected computers and backup drives.

Warning signs

  • Files suddenly won't open, or their names and extensions have changed.
  • A full-screen message demanding payment to unlock your data.
  • Your device slows dramatically as files are encrypted in the background.
  • Security software or system settings have been disabled without your action.

Who it targets

Ransomware hits both individuals and organisations. Hospitals, schools, and small businesses are frequent targets because downtime is costly and backups are often weak. At home, families with irreplaceable photos and no backup are especially vulnerable to the emotional pressure to pay.

How to protect yourself

  • Keep regular backups — one copy in the cloud and one offline drive that you disconnect.
  • Install apps only from official stores, and never run pirated software.
  • Keep your operating system and apps set to update automatically.
  • Be wary of unexpected attachments and fake update pop-ups.
  • Leave the built-in security protection on your phone and computer switched on.

If it happens to you

  1. Disconnect the device from the internet and any other devices at once, to stop it spreading.
  2. Do not pay — instead, look up your files' situation on the free No More Ransom project, which offers many decryption tools.
  3. Restore your files from a clean backup after fully wiping the device.
  4. Report the attack to your national cybercrime authority.