Staying Safe Online · Backups & Bad Days · Lesson 3 of 5

Ransomware in Plain Words

What ransomware does, why paying is risky, and how a backup saves the day.

Your files, held for ransom

Ransomware is a harmful program that locks your files and demands money to unlock them. A ransom is money criminals ask for to give back something they took.

It often gets in through a scam email attachment, a fake download, or a fake pop-up. Once inside, it scrambles your files. Your photos and letters get strange names and will not open. Then a note appears, saying something like "Pay to unlock your files."

It feels awful. But you have choices, and paying is not a good one.

• There is no guarantee you will get your files back. Some people pay and get nothing.
• Paying gives money to criminals. The FBI advises against paying.
• People who pay may be marked as easy targets and attacked again.

Here is what to do instead:

1. Unplug from the internet. Turn off Wi-Fi, or pull out the internet cable. This can stop the ransomware from spreading to your other devices or your cloud files.
2. Get help to clean the computer, from a trusted repair shop or a tech-savvy friend.
3. Restore from your backup. To restore means to bring your files back from the backup copy.

If you have a backup, ransomware is a bad afternoon, not a disaster.

On the practice computer, turn on backup first. Then, when the pretend ransomware hits, try each choice, unplug from the internet, and restore your files.

Report it and stay ready

After ransomware, it helps to tell someone official. Reporting does not always get your files back. But it helps stop the criminals and warn other people.

In the United States, you can report it to the FBI's Internet Crime Complaint Center at ic3.gov. In other countries, look for your national police or cyber security center website.

Write down a few things before you clean the computer:

• What the ransom note said. A photo of the screen with your phone is fine.
• The date and time it happened.
• Anything you clicked or downloaded just before.

If money or bank details were involved, call your bank too. Use the number on the back of your card.

Then, get ready so it can't hurt you next time:

• Keep a backup, and check it now and then.
• Unplug your external drive after each backup. If ransomware strikes while it is plugged in, it might lock the backup too.
• Keep your computer updated. Updates fix weak spots that ransomware uses.
• Be careful with attachments and downloads you weren't expecting.

None of this is hard. A little habit now saves a lot of worry later.