Ransomware

Ransomware is malicious software that encrypts or locks an organization's files and systems, after which criminals demand payment to restore access or to avoid publishing stolen data.

Modern ransomware groups often steal data before encrypting it, then threaten to leak it publicly if the ransom is not paid. This is sometimes called double extortion. Common entry points include phishing emails, stolen passwords, exposed remote desktop connections and unpatched firewalls or VPN devices.

Ransomware can halt operations for days or weeks, and the costs go well beyond any ransom: lost revenue, recovery work, legal advice, privacy notifications under PIPA and damage to client trust. Paying does not guarantee your data will be returned or deleted, and Canadian authorities, including the Canadian Centre for Cyber Security, advise against paying.

Practical tip: the best protection is a combination of multi-factor authentication, prompt patching, endpoint detection and response, and backups that attackers cannot reach or alter. Test restoring from those backups regularly, and keep a printed incident response plan with key contacts in case your systems are unavailable.