Ransomware is malicious software that encrypts your files and holds them hostage. The attacker demands payment — usually in cryptocurrency — for the decryption key. Refuse, and your data is gone. Pay, and you are trusting a criminal to keep their word, funding the next attack, and marking yourself as someone who pays.

Ransomware is no longer a big-corporation problem. Attacks are automated: bots scan the internet for exposed remote-desktop ports and unpatched services, and phishing kits sell as a subscription. A freelancer's laptop holding the only copy of a client project is as valuable a target as a hospital. This guide covers what actually reduces your risk, in the order that matters.

How infection actually happens

Most ransomware arrives through a handful of predictable doors:

Phishing attachments. An invoice.pdf.exe or a macro-laden Word document. The file looks routine; the payload runs the moment you open it or click "Enable Content." This is still the number-one vector, which is why recognizing phishing attacks is one of the highest-leverage skills you can build.
Exposed remote access. Remote Desktop Protocol (RDP) or a VPN left open to the internet with a weak or reused password. Attackers brute-force the login, walk in, and detonate ransomware manually so it does maximum damage.
Unpatched software. A drive-by download exploits an outdated browser, plugin, or server. No click required beyond visiting the wrong page.
Cracked software and fake installers. Pirated games, "free" premium tools, and torrented apps frequently bundle a backdoor that stays quiet until it is ready.

Notice the theme: almost every path involves either a human being tricked or a system left open. Both are things you can control.

Backups are the only guaranteed defense

Everything else on this list reduces the odds of getting hit. Backups are what make a hit survivable. If your data exists somewhere the ransomware cannot reach, you do not negotiate — you wipe the machine and restore. The demand becomes irrelevant.

The classic framework is the 3-2-1 rule:

3 copies of your data (the original plus two backups).
2 different media types — for example an internal drive plus an external disk or cloud.
1 copy kept offsite, so a fire, theft, or flood doesn't take everything at once.

The mistake that kills backups: they're online

Here is where most people go wrong. A backup drive that stays plugged in, or a cloud sync folder that mirrors every change instantly, is not protected. When ransomware encrypts your documents, your always-connected backup dutifully syncs the encrypted versions and overwrites the good ones. You end up with two copies of garbage.

Two ways to fix this:

Air-gapped backups. A drive that is physically disconnected except during the actual backup window. Plug in, copy, unplug. Ransomware cannot encrypt a drive that isn't attached to anything.
Immutable / versioned backups. Cloud services and NAS systems that keep point-in-time snapshots the client cannot delete or alter. Even if the live files are encrypted, you roll back to yesterday's version. Look for the words "object lock," "immutability," or "file versioning."

Test your restores

A backup you have never restored from is a hope, not a plan. Once a quarter, pull a few files back from each backup and confirm they open. Corrupted archives and silent sync failures are common — you do not want to discover them the day you are relying on them.

Harden the doors before someone knocks

Reducing the chance of infection is cheaper than recovering from one. In rough order of impact:

Patch relentlessly. Enable automatic updates for your OS, browser, and anything internet-facing. The exploits used in mass attacks are usually months-old vulnerabilities that already had a fix available.
Close remote access you don't need. Do not expose RDP directly to the internet. Put it behind a VPN, and put multi-factor authentication in front of that. Enabling two-factor authentication on remote access and email is one of the single most effective moves you can make.
Use strong, unique passwords everywhere. Credential reuse turns one breach into ten. A password manager plus a strong password generator removes the temptation.
Run as a standard user, not admin. Day-to-day work should not happen in an administrator account. If malware runs with limited rights, it can do far less damage.
Disable Office macros by default. Most people never need them, and they are a favorite delivery mechanism. Block macros from files that came from the internet.

Adopted together, these habits quietly prevent the majority of infections — none of them require special tooling.

If you get hit: the first hour

Panic makes things worse. Work the sequence:

Isolate immediately. Unplug the network cable, turn off Wi-Fi, and disconnect any external drives. The goal is to stop lateral movement to other machines and to your backups.
Do not power-cycle blindly. Some ransomware keeps decryption material in memory; a reboot can destroy your only recovery chance. Photograph the ransom note first.
Identify the strain. The note usually names the ransomware or leaves a signature. Free decryptors exist for some older or broken families — check reputable resources like the No More Ransom project before assuming the data is lost.
Restore from a clean backup. Wipe the affected machine completely, reinstall the OS, then restore. Never restore onto a system you have not rebuilt.
Rotate credentials. Assume anything typed or stored on that machine is compromised. Change those passwords from a known-clean device, starting with email and banking — the accounts that unlock everything else.

Moving suspicious files without spreading them

Ransomware loves to travel through the same network shares and USB sticks people use to move files around. When you need to hand a suspicious sample, a log bundle, or an encrypted file to an IT specialist or incident responder, do not drop it on a shared drive or email it into an inbox where a mis-click could re-trigger it.

An ephemeral, encrypted link creates a quarantine gap. You upload the file; the recipient pulls it into a sandbox on their own terms; no persistent network bridge forms, and no copy lingers in a mailbox forever. With SnapSend's secure file share the file is encrypted in your browser before it leaves your device, the decryption key travels only in the link fragment (so the server stores ciphertext it cannot read), and the link self-destructs after the first download — exactly the behavior you want for something risky, as covered in why ephemeral file sharing wins.

Quick protection checklist

[ ] Backups follow 3-2-1, with at least one copy offline or immutable
[ ] You have tested a restore in the last three months
[ ] OS, browser, and apps auto-update
[ ] No RDP exposed directly to the internet; MFA on remote access and email
[ ] Unique passwords via a manager; daily account is non-admin
[ ] Office macros disabled by default

FAQ

Should I just pay the ransom? Treat it as a last resort, not a strategy. Payment funds more attacks, marks you as a payer, and buys only a promise — decryptors are sometimes buggy or never delivered. If your backups are sound, you never face the question.

Does antivirus stop ransomware? It helps, but it is a filter, not a wall. New variants routinely slip past signatures. Layer it with patching, least privilege, and backups.

Are Macs and phones safe? Less targeted, not immune. The same principles — backups, MFA, updates — apply everywhere.

Ransomware stops being a catastrophe the moment your recovery plan is stronger than the attacker's leverage. Build the backups first, harden the doors second, and when you have to move a risky file to someone who can analyze it, send it through a self-destructing, end-to-end-encrypted link with SnapSend rather than a shared drive that could pass the problem along.