What is ransomware?

Ransomware is harmful software that prevents access to a device or its files, usually by encrypting them. Criminals demand payment to restore access and may also steal information and threaten to publish it. Paying does not mean you will recover your files. 12

By Secordit. Last checked: 7 November 2026.

Go to the steps · All glossary terms

How it works

  1. Attackers gain access to a device or network. 12
  2. They may steal information and use malware to lock files. 12
  3. They demand payment and may threaten to release the stolen data. 12

Real UK example

In March 2025, the ICO published its findings on the 2022 ransomware attack involving Advanced. Attackers accessed systems through a customer account without multi-factor authentication.

The incident disrupted health services and involved stolen personal information. The findings show why an incident can involve both lost access and a data breach. 3

Warning signs

  • Files are inaccessible and a ransom demand appears. 12
  • A message claims information has been stolen. 12
  • Devices or business systems become unavailable unexpectedly. 12
  • Staff encounter similar lockout messages across several systems. 12

What to do now

  1. Disconnect affected devices from network connections to limit spread. 12
  2. Contact your IT support or incident-response provider. Keep a record of what you can safely observe. 12
  3. Do not rush into wiping devices or restoring backups. Follow an agreed recovery plan and the NCSC’s guidance. 12

UK reporting and support

  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 456
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 57
  • For a business under a live cyber attack in England, Wales or Northern Ireland, Report Fraud also gives telephone support: 0300 123 2040. 85
  • If someone is in danger, call 999. 7

How to protect yourself

  • Maintain offline backups and test whether important files can be restored. 12
  • Keep software updated and use two-step verification for important access. 1291011
  • Plan who makes incident decisions before systems become unavailable. 12

Frequently asked questions

Should I pay a ransomware demand?

The NCSC and UK law enforcement do not support paying. Payment does not promise access to your files or removal of the infection. 1

Does ransomware always involve stolen data?

Not always. But attackers may copy data and threaten to publish it as well as encrypting files. 1

Can I restore a backup onto an infected device?

Do not assume that is safe. The NCSC says both the backup and the device must be clean before restoration. 2

Matching kit

First Hour After a Breach · £29 · Digital download.

An incident-response planning kit for UK small businesses. It is not a live incident-response or legal service.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, What you need to know about ransomware | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  2. NCSC, Ransomware attack | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  3. ICO, Software provider fined £3m following 2022 ransomware attack | ICO. Accessed 7 November 2026 (Europe/London).
  4. UK Finance, Authorised Push Payment Fraud Reimbursement | UK Finance. Accessed 7 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud alert: Police forces being impersonated in scam calls using ‘spoofed’ phone numbers - Report Fraud. Accessed 7 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 7 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 7 November 2026 (Europe/London).
  8. Report Fraud, Guide to reporting cyber crime & fraud - Report Fraud. Accessed 7 November 2026 (Europe/London).
  9. NCSC, Recovering a hacked account | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  10. NCSC, Top tips for staying secure online | Turn on 2-step verification (2SV) | National Cyber Security Centre. Accessed 7 November 2026 (Europe/London).
  11. ICO, 23andMe fined £2.31 million for failing to protect UK users’ genetic data | ICO. Accessed 7 November 2026 (Europe/London).