CISA defines ransomware as malware that encrypts files and demands payment for a decryption key that unlocks them. For home users, warning signs include lock screens and ransom notes, and protection means offline backups and free recovery help. CISA warns in its CISA ransomware FAQs that anyone with an internet-connected computer is at risk, including individuals. CISA's #StopRansomware Guide says attackers now often steal data before encryption and threaten to publish or sell it.
Table of Contents
- How do you spot it on a home computer?
- Why does paying for the key fail?
- What should you do after the lock appears?
- How do you keep backups that survive attack?
How do you spot it on a home computer?
The Department of Homeland Security describes the classic sign as a pop-up saying the computer is locked or files are encrypted. The Department of Homeland Security cites a deadline such as $500 within 72 hours in its Homeland Security alert on ransomware. The Europol-backed No More Ransom project says encryption ransomware targets documents, photos and videos.
It deletes the originals, leaves payment instructions in the folder, and sometimes shows a lock screen. Do not wait to see every sign. One lock message plus unreadable photos or documents is enough to act.
- A pop-up or lock screen saying files are encrypted.
- Payment instructions left inside the affected folder.
- A payment deadline pressuring quick action.
Why does paying for the key fail?
No More Ransom advises consumers never to pay. Payment tells criminals the method works and brings no guarantee of a working key, because malware bugs can leave data unrecoverable. CISA's #StopRansomware Guide warns of double extortion.
Attackers steal files first, then threaten to publish or sell them unless paid. That second threat changes the choice. A purchased key cannot force criminals to delete stolen copies.
What should you do after the lock appears?
Do not delete the ransom notes. Keep the messages for recovery help. The FBI says it held more than 7,000 LockBit decryption keys by June 2024.
The FBI urges suspected victims to contact a local field office or file for free help in its FBI report on LockBit victims. No More Ransom cautions that not every ransomware family has a free solution. If no key exists, clean recovery depends on backups you kept before the attack.
- Do not pay for the key.
- Keep ransom notes and lock-screen details for investigators.
- Contact a local FBI field office for free recovery help.
How do you keep backups that survive attack?
No More Ransom tells home users to keep two backup copies. No More Ransom says one copy should stay on an offline drive disconnected after backup.
No More Ransom also recommends automatic cloud backup in its prevention advice for home users. Offline copies matter because encryption cannot reach a drive that is unplugged. No More Ransom notes this setup keeps infection from destroying data permanently.
- Back up photos, documents and videos.
- Disconnect the offline drive right after backup.
- Leave automatic cloud backup turned on.
You Might Also Like
- Cybersecurity — Known Exploited Vulnerability for Consumers: Warning Signs and Protective Steps
- Teen Ransomware Suspect Allegedly Led Gang Behind Hundreds of Attacks
- Ransomware Recovery Risk Guide: Data Exposed, Fraud, and Identity Theft