← All glossary terms Glossary

What is Ransomware?

Malicious software that encrypts your data and demands payment for the key — often combined with data theft and extortion.

Ransomware encrypts a victim's data and demands payment for the key to unlock it. Modern ransomware crews almost always also steal data before encrypting, and threaten to publish it if the ransom is not paid — a tactic called double extortion. Ransomware is rarely the first action in an attack: it follows initial access, credential theft, lateral movement, and reconnaissance — usually hours or days earlier. Catching those earlier stages is the difference between a contained incident and a full encryption event.