Ransomware
Malware that encrypts data and demands payment for decryption — often with data-theft extortion.
Ransomware can encrypt systems and disrupt operations. Some attacks also steal information and threaten disclosure, commonly described as double extortion. Ransomware-as-a-Service operations may involve different parties providing the malware and carrying out intrusions.
Review both recovery needs and possible information exposure. Restoring files alone does not resolve every consequence of an incident.
Plan for loss of confidentiality and availability
A ransomware incident can interrupt operations and involve stolen information, even when files can be restored. Identify critical services, dependencies, and sensitive data before deciding what recovery requires. A working backup does not undo data theft or eliminate the need to investigate notification obligations.
Prepare actions before an incident
Maintain protected backups and test restoration, reduce unnecessary administrator access, patch relevant systems, and establish a reporting channel. An incident plan should identify who can isolate systems, contact providers, preserve evidence, and make business decisions. Exercise those responsibilities rather than assuming the written plan will be enough under pressure.
Respond with specialist support
If an incident is suspected, follow the established response process and involve qualified responders. Avoid improvising destructive cleanup that may erase evidence. Recovery, insurer coordination, legal obligations, and any payment-related decision depend on the actual facts; generic guidance cannot promise safe recovery or rule out sanctions exposure.
Related terms
See how Scarlet Risk covers Ransomware.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo