Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Ransomware is malicious software—or an attack involving it—that blocks access to files, systems, or networks, usually by encrypting data, then demands payment to restore access. Some attackers also steal information and threaten to publish it, adding pressure even if a victim has working backups.
What ransomware does
CISA defines ransomware as “a form of malware designed to encrypt files on a device, rendering them and the systems that rely on them unusable.” The definition appears in its #StopRansomware Guide, revised October 19, 2023.
Encryption is common, but the damage can extend beyond files a person cannot open. Systems that rely on those files may stop working, and an organization may lose access to information needed for normal operations. Attackers typically demand payment in exchange for a decryption key or other promise of restoration; paying does not ensure that they will deliver.
How ransomware can reach a device or network
There is no single route used in every incident. A person might encounter malware through a malicious link or attachment, an advertisement, or a compromised website. Attackers may also exploit software vulnerabilities or use compromised credentials to gain access. The FBI’s ransomware guidance lists several of these possible entry points.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
One illustrative chain described by NIST’s Small Business Cybersecurity Corner begins when someone clicks a malicious link, downloads and runs a file, and ransomware then exploits vulnerabilities to spread and encrypt files on multiple computers. That example helps explain how an incident might grow; it is not a fixed sequence that every attacker follows.
What double extortion means
In a double-extortion attack, criminals both encrypt data and steal information, then threaten to disclose the stolen material unless the victim pays. That threat can remain even if the victim can restore encrypted files from backups.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Some extortion attacks threaten disclosure without encrypting files. CISA’s ransomware guidance describes data exfiltration and extortion as tactics that can be used alongside encryption or without it. Neither tactic is part of every ransomware incident.
How to reduce the risk and prepare for recovery
Keep devices and software current
Install updates for operating systems, applications, and other software, and maintain updated antivirus and anti-malware protection. These steps address known weaknesses and common ways malware may reach a device; they cannot guarantee that an attack will not happen. These are among the precautions recommended by the FBI’s IC3 ransomware guidance.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Make backups that an attack cannot easily reach
Back up important data, confirm that each backup completed, and keep backup copies separate from the devices and networks they protect. For organizations, CISA recommends offline, encrypted backups of critical data and regular checks that the copies are available and intact. A backup connected to an affected network may also be found, deleted, or encrypted by attackers.
An external hard drive can serve as one destination for an offline backup: encrypt it, disconnect it after use, and test that files can be restored. A single drive is not automatically a complete recovery plan. Organizations should consider multiple recovery copies and establish how they will restore systems, not just store files.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Plan for an incident before one occurs
Organizations should know which devices and systems they operate, prepare incident-response and communications plans, and choose security controls that address their likely exposure. NIST’s IR 8374 Revision 1, published in June 2026 and aligned with Cybersecurity Framework 2.0, organizes ransomware risk management around governance, identification, protection, detection, response, and recovery.
What to do if ransomware is suspected
For an organization, use its approved incident-response plan and involve qualified responders. Avoid improvising changes that could destroy useful evidence or spread the incident further.
- Identify and isolate affected systems. Follow the organization’s response plan and CISA’s ransomware checklist. If several systems or network segments appear affected, broader network isolation may be necessary.
- Preserve relevant evidence. Keep logs and other incident information where feasible. Record what systems appear affected and when the activity was noticed.
- Coordinate response and notifications. Contact law enforcement and qualified incident-response support. If information may have been breached, coordinate any required notifications through the organization’s established process.
- Restore cautiously. Use clean, offline backups and take care not to reconnect compromised systems or restore into an environment where the attacker remains present.
- Report the incident. The FBI’s Internet Crime Complaint Center asks victims to submit a detailed complaint. Useful details include the ransomware variant if known, encrypted file extensions, attacker contact details, the demand amount, and whether any payment was made.
Individuals should similarly report the incident and seek help from law enforcement or a qualified responder. Preserve the ransom note and related details if it is safe to do so.
Should a victim pay the ransom?
The FBI does not support paying. Payment does not guarantee that attackers will restore access or refrain from publishing stolen data, and it can encourage further attacks. Contact law enforcement and qualified responders rather than treating payment as a dependable recovery method. Law enforcement may know of decryptors for some ransomware variants, but availability depends on the variant and is not assured.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →
