Ransomware

Ransomware is a malicious computer program that criminals secretly install on other people’s computers. There, it encrypts the stored files: texts, photos, accounting records, patient files. Encryption means the data is converted using a secret procedure so that it becomes nothing but scrambled gibberish. Anyone without the matching key does not get it back. A demand then appears on the screen: pay a certain amount, and you will receive the key. The English word “ransom” gives the name its meaning — hence the term.

Why one click can shut down a hospital

Ransomware is today the most expensive form of internet crime. The reason is simple: victims are under enormous time pressure. A logistics company without access to its warehouse data cannot make deliveries. A hospital without patient files must postpone operations. Every day of downtime costs money or endangers people.

This is exactly what the perpetrators count on. They demand sums that hurt but seem payable — for corporations, often amounts in the millions. Many attackers additionally steal the data before encrypting it. Then they threaten to publish it. This double extortion works even when the victim has good backup copies.

For investors and news readers, this is relevant because such incidents move stock prices. An attack can spoil quarterly results and often must be publicly reported. Insurance against cyber damage has become its own multi-billion-dollar market.

The path from attachment to ransom demand

Most attacks begin with a deceptively genuine-looking email. An employee opens an attachment or enters their password on a fake login page. Alternatively, the perpetrators exploit a security gap in outdated software that is accessible from the internet. Either way, this gives them an initial foothold.

After that, apparently nothing happens for weeks. The attackers look around the network, copy data, and search for the system administrators' access credentials. Only once they have gained enough control do they start the encryption — often on a Friday evening, when no one is in the office. At the same time, they delete the backup copies so the victim has no alternative.

Payment is almost always made in cryptocurrency, meaning digital money with no bank behind it. Such payments are hard to trace to a specific person. Rarely are lone perpetrators behind this: there are groups that rent out their malicious software like a product to other criminals and take a cut of the ransom. Experts call this Ransomware-as-a-Service.

What actually helps against extortion trojans

News about ransomware appears regularly: in recent years, victims have included university hospitals, city administrations, auto parts suppliers, and a major US pipeline. Private individuals are affected too, often with smaller demands in the three-digit range. Germany’s Federal Office for Information Security has for years called ransomware the greatest threat to IT security in Germany.

The most important protection is unspectacular: regular backup copies kept separate from the network. An external hard drive that is only plugged in for copying cannot be encrypted along with everything else. In addition, prompt software updates and a second layer of security when logging in, such as a code sent to a phone, are essential.

A common misconception is that paying settles the matter. Some victims never receive a working key, while others are attacked again months later. Police and security authorities therefore explicitly advise against paying. It is also important to draw a distinction: ransomware is a subtype of malware, meaning malicious software in general. A virus that merely deletes data, or a program that reads passwords, does not demand a ransom — and is therefore not ransomware.