Ransomware: What It Is and How It Affects Households

Ransomware is a type of malicious software, or malware, that threatens to publish your data or blocks access to it, usually by encrypting it, until you pay a ransom fee to the attacker¹. In practice that means your computer, phone or tablet may become locked, or the files on it may be stolen, deleted or encrypted, and a criminal group then demands a ransom in exchange for decryption². Payment is usually demanded via an anonymous web page or email address, and usually in a cryptocurrency such as Bitcoin⁴.

For a household, ransomware matters in two ways. Directly, it can lock you out of your own photos, documents and accounts. Indirectly, attacks on the organisations you rely on, such as councils, hospitals and water companies, can disrupt services for weeks or months. Ransomware remains the greatest cyber crime threat in the UK, and UK authorities have identified it as the number one cyber threat to the nation¹. The two protections that matter most for your own devices are simple: keep a recent offline backup of your important files, and install software updates as soon as they appear.

What ransomware actually does to your device

Ransomware is malicious software that prevents you from accessing your computer, or the data stored on it³. It belongs to the wider family of malware, which includes viruses, Trojans and worms: code that can harm your computers and laptops, and the data on them⁹. What separates ransomware from other malware is the demand that follows. Ransomware makes your data or systems unusable until the victim makes a payment¹¹. Normally you are asked to make that payment, the ransom, in order to unlock your computer or access your data, usually by contacting the attacker via an anonymous email address or following instructions on an anonymous web page, and paying in a cryptocurrency⁵.

Two things can happen, and sometimes both at once. The computer itself may become locked, or the data on it might be stolen, deleted or encrypted³. Increasingly, the National Cyber Security Centre (NCSC) is seeing data extortion as a fundamental part of the ransomware business model, as criminals realise that stealing data gives them a second way to pressure victims: pay up, or we publish it⁴. So even if you could live without the locked files, an attack can expose whatever personal information was on the device.

The impact on victims can be significant: financial, data and service losses, which in the case of organisations can lead to business closure, inaccessible public services and compromised customer data¹. Its use threatens Critical National Infrastructure and poses a risk to national security, which is why ransomware is treated in the UK as a national security risk rather than just a crime problem¹. For more on the wider family of malicious software and how to remove it, see our guide to malware on a computer or phone.

If your device is locked: disconnect it straight away

If a device suddenly shows a ransom note, or files will not open and display odd extensions, act immediately. The NCSC's guidance for a ransomware attack is to disconnect the infected computers, laptops or tablets from all network connections straight away, whether wired, wireless or mobile phone based⁵. That means pulling out the network cable, turning off your Wi-Fi, and switching off mobile data. The same advice appears in the NCSC's WannaCry guidance for home users: immediately disconnect your computer, laptop or tablet from the network and turn off your Wi-Fi¹².

The reason is that ransomware spreads. Every moment a locked device stays connected is a moment the malware can reach other devices on your home network, and anything attached to them. That includes your backup.

After disconnecting, do not rush to reinstall or reconnect anything. Follow the NCSC's guidance on what to do with an infected device, and only restore files once the device itself is clean. Our page on how to restore files safely after ransomware or a virus walks through that step. If accounts rather than files were compromised, the NCSC's recovery steps include applying updates to your apps and device software as soon as they are available, because updates include protection from viruses¹⁵.

Paying the ransom does not guarantee you get your files back

The NCSC is blunt about this. There is no guarantee that you will get access to your data if you pay¹¹. Your computer will still be infected unless you complete extensive clean-up activities, and you will be paying criminal groups¹². The NCSC's ransomware attack guidance repeats the point: even after payment, your computer will still be infected⁵.

A parliamentary report on ransomware and UK national security goes further: mass data loss from an attack can be irreversible, even when the ransom is paid⁶. And the NCSC's annual review notes that when a ransom is paid, computer or networks will still be infected⁴.

The official position is clear. The NCSC and UK law enforcement do not encourage, endorse or condone the payment of ransom demands⁵. In November 2022 the heads of the NCSC and the Information Commissioner's Office wrote jointly to the Law Society and Bar Council making clear that paying a ransom incentivises harmful behaviour and does not guarantee decryption or the return of stolen data⁴. The Government has also consulted on counter-ransomware legislation, including a targeted ban on ransomware payments for regulated critical infrastructure and the public sector, a ransomware payment prevention regime, and a mandatory incident reporting regime¹⁶.

For a household, the practical conclusion is simple: the only reliable way to get your files back is from a backup you made before the attack. Our page on whether you should pay a ransomware or sextortion ransom covers the decision in more detail.

An offline backup is the protection that matters most

Because payment guarantees nothing, the backup is everything. The NCSC's annual review states it plainly: it is important to always have a recent offline backup of the most important files and data⁴. The Cyber Aware campaign gives the same advice to households: safeguard your most important data, such as your photos and key documents, by backing them up to an external hard drive or a cloud-based storage system¹⁷.

"Offline" is the word that does the work. A backup that is permanently connected to your network is within reach of the ransomware, and the NCSC warns that ransomware can move to attached media automatically and infect the backup¹³. So the routine that protects you is:

• Back up your most important files, such as photos and key documents, regularly¹⁷
• If the backup is on removable media, a USB stick or external hard drive, disconnect it once the backup is finished and keep it somewhere separate¹²
• Do not leave backup media connected to your network or any device on it¹²
• Consider a second copy in cloud storage, so a single incident cannot reach both¹⁷

How often to back up depends on how much you could bear to lose; our guide on how often you should back up your data helps you decide, and how to protect your backups from ransomware covers the risks in depth. If you are weighing up where to keep your copies, see cloud backup or external hard drive: which suits your home, and for the full method, backing up files and photos at home.

Keep software updated: unpatched systems are how attacks get in

Ransomware needs a way in, and outdated software provides it. Hackers often use outdated software to hack devices; updates fix known security issues and add new security features to help keep you safe, as the RNIB's guidance for staying safe online puts it¹⁸. The NCSC's advice on scam parcel texts is the same: ensure your device is kept up to date by installing the latest software and patches¹⁹. For PCs and laptops, make sure you have antivirus and install security updates as soon as they are available, ideally by setting them to install automatically²¹.

The clearest lesson comes from the WannaCry attack of May 2017. On Friday 12 May 2017 a global ransomware attack affected more than 200,000 computers in at least 100 countries²². In the UK it particularly affected the NHS, although the NHS was not the specific target²². The National Audit Office's investigation found that all the NHS organisations infected by WannaCry had unpatched, or unsupported, Windows operating systems, so they were susceptible to the ransomware²³. A North Yorkshire community risk register makes the same point: many organisations had not applied the recommended software updates in a timely manner, which left systems vulnerable⁸.

That is the whole game in one sentence. When a manufacturer fixes a flaw, the fix is public, and criminals race to exploit every device that has not yet installed it. Set updates to install automatically where you can; our page on whether you should turn on automatic updates explains how, and what happens when your phone stops getting updates covers the end-of-support problem that left so many Windows machines exposed in 2017. The full detail of that incident is in WannaCry: how the 2017 ransomware hit the NHS.

How ransomware reaches phones and home computers

Ransomware does not appear on a device by magic. It arrives the same way other malware does, usually through a message that tricks you into clicking a link, opening an attachment or installing something. The NCSC's guidance on scam "missed parcel" text messages describes the pattern: cyber criminals trick UK citizens into downloading malware by sending scam texts containing links to what appear to be official delivery or parcel-tracking apps, which you are encouraged to install, but the "app" is in fact malware¹⁹. The protection that follows is to keep your device up to date and only install apps from official app stores such as Google Play, the Apple App Store or the Samsung Galaxy Store²⁰.

The coronavirus period showed how quickly criminals adapt their lures. An official joint advisory from April 2020 described a malicious Android app purporting to provide a real-time coronavirus outbreak tracker, which instead tricked the user into providing administrative access²⁴. The same advisory described SMS messages purporting to be from "COVID" and "UKGOV" that used a UK government themed lure to harvest email, address, name and banking information, and noted that Trojans such as TrickBot or GraceWire will download further malicious files, including ransomware²⁴. Ofcom's guidance on coronavirus scam calls and texts adds the general rule: scam texts often include links or attachments which cannot be trusted, so do not click on them, and if you receive such a text, ignore it and delete it²⁵.

The scale of what one campaign can do is worth knowing. The WannaCry attack of 2017 affected more than 200,000 computers in over 150 countries⁷. The MOVEit exploit of 2023 initially impacted up to 130 organisations and involved the extraction of the personal information of around sixteen million individuals globally⁷. Most of those victims were organisations, but the personal data extracted belonged to individuals, which is how a "distant" cyber attack reaches your household. If your details are exposed, see your details in a data breach: what to do next, and for the everyday craft behind these attacks, phishing: how to spot a scam email, text or call.

Ransomware is the UK's greatest cyber crime threat

It is worth understanding why officials talk about ransomware the way they do. Ransomware remains the greatest cyber crime threat in the UK¹, and a parliamentary committee reported in December 2023 that ransomware has been identified by UK authorities as the number one cyber threat to the nation⁶. The UK is one of the most targeted countries in the world for ransomware, with some estimates putting it second only to the US⁷. The true numbers of attacks each year are far higher than reported figures, as organisations often do not report the compromises⁴.

The National Crime Agency's director general has described ransomware as "the one serious organised crime that could bring the country to a standstill"⁷. The majority of ransomware attacks against the UK are from Russian-speaking perpetrators, and most of the criminal groups that target the UK continue to be based in and around Russia⁶. The main strains targeting the UK between 2020 and 2022, Conti and Lockbit, were described as "some of the world's most sophisticated", responsible for attacks at the cutting edge of the field⁷. Conti was reported discontinued in May 2022, though its members moved to other ransomware groups⁴.

The economic stakes are large. The Office for Budget Responsibility has assessed that a major UK cyber-attack, which might take the form of a ransomware attack, could result in a shock to the economy of 1.6% of GDP, adding £29 billion to Government borrowing⁷. The 2023 National Risk Register likewise warns that recovery from a serious incident can last months, years or even decades²⁶. These figures are a guide to scale rather than a forecast, but they explain why the NCSC and Government have focused their counter-ransomware efforts predominantly on resilience, and why the Home Office claims the lead on ransomware as a national security risk and policy issue⁶.

When an attack on a council, hospital or water company affects your household

Most households will experience ransomware indirectly: an attack on an organisation you depend on. Targets have included local government systems, healthcare providers, schools and businesses²⁷. The Local Government Association has identified ransomware as the number one cyber security risk to councils, with risks to local authorities still increasing⁷. A parliamentary report notes that ransomware can cause severe disruption to the delivery of core Government services, including healthcare and child protection⁶.

The recent UK record shows what that looks like in practice:

The pattern for a household is disruption rather than danger: payments delayed, appointments moved, online services unavailable. Practical preparation is the same as for any IT outage. Keep key information offline so you can still reference account numbers, medicines and contacts; see keeping key records offline. Know what to do when council online services are down, when your water, energy or phone company is hacked, and how NHS appointments, A&E and tests work during an IT outage. If payment systems are affected, our guides to paying for essentials when card machines and banking apps fail and when banks, shops and public services go offline set out the steps.

Recovery for these organisations is slow, which sets your expectations for how long disruption may last. Many organisations take months to recover, with long recovery times of up to a year for some⁶. One victim organisation told a parliamentary roundtable in May 2023 that it was two-and-a-half years past the attack and still not fully recovered, having rebuilt its systems from scratch⁷. Abroad, the Colonial Pipeline was shut down for six days after a ransomware attack in May 2021, affecting 17 US states and causing fuel shortages and flight re-routings⁷. When a local service goes down after an attack, assume weeks, not hours.

Where to get help

If ransomware hits your household, you are not entirely on your own, though support is limited. A parliamentary committee found that most victims currently receive next-to-no support from law enforcement or Government agencies⁶. What exists is guidance: the NCSC publishes advice on responding to and recovering from a ransomware attack, including the first steps of disconnecting and assessing what has been lost⁵, and guidance on what to do with a hacked device²⁹. Scam messages can be reported, and Ofcom advises ignoring and deleting scam texts and reporting them²⁵.

For the related problems that follow an attack, our step-by-step pages cover what to do if an online account is hacked, how to recover a hacked email account, and what to do after fixing an infected device. Our home online security checklist gathers the baseline behaviours for households in one place. The wider context of how the NHS, government and regulators respond to a major incident is covered in how services respond, and the NCSC's own role in help for individuals and families.