What is ransomware? Definition + 5 types + how it spreads + 2026 prevention checklist

Ransomware is a type of malware that encrypts a victim's files (or locks their device) and demands payment — usually in cryptocurrency — in exchange for restoring access. Modern ransomware increasingly uses "double extortion": encrypting files AND threatening to leak stolen data publicly if the ransom isn't paid. The largest 2025-2026 ransomware families include LockBit 4.0, BlackCat/ALPHV-ng, Cl0p ( MOVEit exploitation), Akira, and Play. Ransomware-as-a-Service (RaaS) is the dominant business model — ransomware developers lease their malware to affiliates in exchange for a cut of the ransom (typically 20-30%). The FBI received 2,825 ransomware complaints in 2025 totaling $59.6 million in adjusted losses — but actual losses including downtime, remediation, and reputational damage are estimated at $20-30 billion annually.

Ransomware targets businesses of all sizes, government, healthcare, education, and individuals. Critical infrastructure (hospitals, energy, water utilities) is increasingly targeted by state-sponsored ransomware operators. The most effective defense is the 3-2-1 backup rule (3 copies, 2 different media, 1 offline) combined with patch management, multi-factor authentication, and endpoint detection. For victims: the FBI recommends not paying the ransom — paying doesn't guarantee file recovery and encourages further attacks.

What is ransomware definition?

Ransomware is malicious software (malware) that holds a victim's data or device hostage until a ransom is paid. The word combines "ransom" + "malware." Ransomware typically works by:

1. Infiltration — gains access via phishing email, exploited vulnerability, or stolen credentials
2. Lateral movement — spreads across the network to maximize damage
3. Encryption — encrypts files using strong cryptography (AES-256 + RSA-2048 typically)
4. Extortion note — displays a ransom demand, often with countdown timer
5. Negotiation — victim either pays, restores from backups, or loses data

The first documented ransomware — the AIDS Trojan (1989) — was distributed via floppy disks and demanded $189 sent to a Panama PO Box. Modern ransomware is a multi-billion-dollar criminal industry with affiliates, developers, initial access brokers, and laundering services.

What are the 5 types of ransomware?

The five main types of ransomware in 2026:

Type	How it works	Notable examples
Crypto ransomware / Encryptors	Encrypts files; demands payment for decryption	LockBit 4.0, BlackCat/ALPHV, Akira
Locker ransomware	Locks the entire device (not files); victim can't log in	Police-themed "locker" scams
Double extortion ransomware	Encrypts files AND threatens to leak stolen data	Cl0p, BlackCat, most modern strains
Triple extortion ransomware	Adds DDoS attacks or customer harassment to double extortion	Royal Ransomware, Black Basta
Wiper ransomware	Destroys data (no recovery possible); disguises as ransomware	Shamoon, NotPetya, WhisperGate
RaaS (Ransomware-as-a-Service)	Subscription model: developer leases to affiliates	LockBit 4.0, BlackCat (operated as RaaS)

The dominant trend is double + triple extortion — even if you have backups, attackers threaten to leak your data publicly (regulatory fines, customer churn, reputational damage). Some groups add DDoS attacks or call customers directly to pressure victims.

How does ransomware spread in 2026?

The 6 most common ransomware infection vectors in 2026:

1. Phishing emails (~35% of infections) — fake invoices, shipping notices, HR documents with malicious attachments
2. Exploited vulnerabilities (~20%) — unpatched software (VPN appliances, file transfer tools like MOVEit, Confluence, Citrix)
3. Stolen credentials (~20%) — bought from initial access brokers (IABs) on dark web forums for $5-500
4. Supply chain attacks (~10%) — malicious code injected into legitimate software updates (Kaseya VSA, SolarWinds, 3CX)
5. Remote Desktop Protocol (RDP) brute force (~8%) — exposed RDP endpoints with weak passwords
6. Malvertising / drive-by downloads (~5%) — malicious ads on legitimate websites

The fastest-growing vector in 2026 is supply chain attacks — breaching one MSP or software vendor can compromise thousands of downstream customers. AI-powered ransomware is also emerging: malware that uses machine learning to evade detection, select high-value targets, and adapt encryption in real-time.

What are the biggest ransomware attacks of 2025-2026?

The 8 largest ransomware attacks of 2025-2026:

Attack	Date	Victim	Records / impact	Strain
Change Healthcare	Feb 2024	UnitedHealth subsidiary	190M individuals affected	BlackCat/ALPHV
MOVEit mass exploitation	May-June 2023	2,500+ organizations	70M+ individuals	Cl0p
Colonial Pipeline	May 2021	US fuel pipeline	$4.4M ransom paid	DarkSide
Kaseya VSA	July 2021	MSP + 1,500 customers	1,500+ businesses	REvil
Broward Health	Oct 2021	FL hospital system	1.3M patients	Conti
Acer	Mar 2021	Computer maker	$50M ransom demand	REvil
JBS Foods	June 2021	Meat processor	$11M ransom paid	REvil
Costa Rica government	Apr-May 2022	National government	State of emergency declared	Conti

Change Healthcare (Feb 2024) is the largest healthcare data breach in US history — 190 million individuals' medical, insurance, and financial data exposed. The ransom was reportedly $22M.

How can you prevent ransomware in 2026?

The 2026 ransomware prevention checklist:

Prevention	Why it works
3-2-1 backups (3 copies, 2 media, 1 offline)	Only reliable recovery; air-gapped backup can't be encrypted
Multi-factor authentication (MFA) on all accounts	Blocks 99% of credential-based attacks
Patch management within 14 days of CVE release	Closes exploited vulnerabilities
Endpoint Detection & Response (EDR)	Detects encryption behavior, not just signatures
Email filtering + DMARC	Blocks phishing emails at gateway
Disable unused RDP / restrict to VPN	RDP is a top infection vector
Network segmentation	Limits lateral movement after initial breach
Zero Trust Architecture	"Never trust, always verify" — even internal traffic
Disable Office macros (or sign only)	Macro-based attacks remain common
Annual tabletop exercises	Practice response before an incident
Cyber insurance review	Coverage is increasingly scrutinized

The 3-2-1 backup rule is the single most effective defense — if you have an offline backup, ransomware can't encrypt it, and you can restore without negotiating with attackers. Test your backup restore process quarterly; backups that haven't been tested are not reliable backups.

What should I do if I get ransomware?

The 7 immediate steps after a ransomware attack:

1. Isolate affected systems — disconnect from network (Wi-Fi off, ethernet unplugged)
2. Don't pay the ransom — FBI recommendation; no guarantee of recovery, encourages further attacks
3. Contact law enforcement — FBI IC3 (ic3.gov), CISA, or local cybercrime unit
4. Engage incident response professionals — firms like Mandiant, CrowdStrike, Sophos IR
5. Preserve evidence — don't wipe or reboot before forensic imaging
6. Notify stakeholders — customers, regulators (varies by jurisdiction), board
7. Restore from backups — only after attacker access is fully removed

Key decisions:

• Pay vs. don't pay: FBI, CISA, and most cybersecurity insurance carriers recommend NOT paying. Cyber insurance often covers recovery costs but NOT the ransom itself (many carriers now have policy exclusions).
• Restore from backup vs. decrypt: restoring from a clean offline backup is faster (hours vs. days) and more reliable than paying for a decryptor.
• Public disclosure: most US states have data breach notification laws (typically 30-60 days). EU GDPR requires 72-hour notification. Check your jurisdiction.

How is ransomware different from malware?

Ransomware is a subset of malware — all ransomware is malware, but not all malware is ransomware. Malware is the umbrella term for any malicious software (viruses, worms, trojans, spyware, adware, ransomware). Ransomware specifically holds data hostage for payment.

The key differentiator is the extortion model: ransomware monetizes the attack by demanding payment for decryption/release, while other malware monetizes through theft (spyware, infostealers), fraud (banking trojans), or paid advertising (adware). Ransomware is the most financially damaging category — average cost per incident in 2025 was $5.13 million (excluding ransom), according to Sophos State of Ransomware 2025.

What is ransomware as a service (RaaS)?

Ransomware-as-a-Service (RaaS) is a subscription business model where ransomware developers lease their malware to affiliates in exchange for a cut of the ransom (typically 20-30%). RaaS has democratized ransomware — anyone with basic technical skills and a few thousand dollars can launch sophisticated attacks.

Major RaaS operations in 2026:

• LockBit 4.0 — the most prolific RaaS in 2024-2025; the developer "LockBitSupp" operates the platform
• BlackCat/ALPHV-ng — Rust-based ransomware, highly sophisticated
• Akira — targets healthcare and education
• Play — uses intermittent encryption for speed
• Cl0p — specializes in mass exploitation (MOVEit, GoAnywhere, Cleo)

Law enforcement has had some success disrupting RaaS operations: the FBI seized LockBit infrastructure in Feb 2024 (operation Cronos), and BlackCat exit-scammed affiliates in March 2024 — but new operations emerge quickly.

What is the average ransomware ransom?

The average ransomware payment in 2025 was $850,700 (median $200,000), according to Sophos State of Ransomware 2025. But demands are much higher for "big game hunting" — attacks on large enterprises often demand $5-50 million, and some demands have exceeded $100 million (Acer was demanded $50M, CDK Global paid $25M after a June 2024 attack).

Note: paying the ransom doesn't guarantee recovery. Sophos found that only 65% of organizations that paid got their data back in 2025, and the recovered data was often incomplete or corrupted. The total cost of recovery (downtime, remediation, legal, lost revenue) typically exceeds the ransom by 5-10x.

What is the bottom line on ransomware?

Ransomware is the most financially damaging cyber threat in 2026 — encrypting files and demanding payment, increasingly with data-leak extortion. The 5 types are crypto, locker, double extortion, triple extortion, and wiper. The dominant business model is Ransomware-as-a-Service. The most effective defenses are 3-2-1 backups, MFA, patch management, and EDR. If attacked: isolate, don't pay, contact law enforcement, restore from backup.

For related threats, see our What is malware? page (ransomware is a subset), What is phishing? page (35% of ransomware starts with phishing), What is 2FA? page (MFA blocks 99% of credential-based ransomware), What is identity theft? page (post-attack), and What is a data breach? page (data leak extortion is ransomware's leverage).