What Is Ransomware? A Plain English Guide for Business

By Ollie Hill-Haimes, Sales Director | 8 min read · Mar 2026

What does ransomware actually do?

Ransomware is malware that takes your data hostage. When it runs on a computer or server, it rapidly encrypts files — documents, spreadsheets, databases, emails — using cryptographic keys only the attacker holds. The files become unreadable, and the attacker demands payment, usually in cryptocurrency, for the key to restore them.

The "ransom" analogy is accurate. Like a kidnapping, the attacker controls something you need — access to your own data — and will return it only if you pay. Even then, payment is no guarantee of recovery. The UK's National Cyber Security Centre is blunt about this: it advises organisations not to pay, because payment funds crime and does not reliably get your data back.

How does ransomware get into a business?

Ransomware does not appear from nowhere. It follows a deliberate delivery process, and almost every successful attack starts with one of three routes. Closing these three doors removes the overwhelming majority of your exposure, which is why they sit at the centre of any sensible defence plan.

• Phishing emails: A user receives an email with a malicious attachment (a Word, Excel or PDF with an embedded macro) or a link to a malicious page. Open it, and the payload downloads and runs. Disciplined phishing protection shuts down the most common entry point.
• Compromised credentials: Attackers harvest usernames and passwords from phishing, breach databases or weak-password guessing, then log into internet-facing services — VPN, Remote Desktop (RDP), cloud apps — and deploy ransomware from inside.
• Unpatched vulnerabilities: Some campaigns exploit known software flaws with no user interaction at all. The WannaCry attack of 2017, which disrupted NHS services, exploited an unpatched Windows flaw to spread automatically. Consistent patching and vulnerability management closes this gap.

What happens during a ransomware attack?

A typical attack is not a single event — it is a campaign that unfolds over days or weeks before the visible damage. Understanding the sequence matters, because the window between initial access and encryption is exactly where detection saves you.

1. Initial access: The attacker gains a foothold via phishing, stolen credentials or an exploited vulnerability. 2. Reconnaissance: They map the network — file servers, databases, backups, domain controllers — to find what is valuable. 3. Credential harvesting: They steal more credentials, often administrator accounts, to widen access and stay persistent. 4. Data exfiltration: In double-extortion attacks, sensitive data is copied out before encryption to create extra leverage. 5. Detonation: The ransomware deploys across the network, encrypting workstations, file servers and cloud-synced storage. 6. Ransom note: A message appears on infected systems with instructions for payment.

Steps 1–4 can take days or weeks. Steps 5 and 6 happen in minutes to hours — and that is usually the moment a business first realises it has been breached. This is the case for managed detection and response: catching the intruder during the quiet reconnaissance phase, not after the files are gone.

What are the real UK examples?

Ransomware is not abstract. UK organisations hit by significant attacks in recent years show the scale, from national infrastructure to ordinary SMEs that never make the headlines. The pattern is consistent: serious disruption, weeks of recovery, and costs that dwarf any ransom.

• NHS England (June 2024): A ransomware attack on pathology provider Synnovis disrupted blood testing across London hospitals, postponing operations and triggering blood shortages. It was attributed to the Qilin ransomware group.
• Royal Mail (January 2023): An attack disrupted international parcel and letter services for weeks. Royal Mail refused to pay a ransom demand widely reported at the time as £65.7 million.
• UK SMEs: The NCSC's incident data records hundreds of ransomware cases against small businesses each year that never reach the news but carry equally severe consequences. The UK Government's Cyber Security Breaches Survey tracks how widespread these incidents have become.

Why is double extortion so dangerous?

Double extortion is when attackers steal a copy of your data before encrypting it, then threaten to publish it on a dark-web leak site unless you pay. It defeats the "we have backups" defence, because restoring your files does nothing to stop sensitive data being leaked.

This model creates pressure even for organisations with clean backups. The threat of customer records, contracts, employee data or commercially sensitive material being dumped publicly adds a second lever the attacker can pull. Preventing exfiltration in the first place — through rapid detection during the dwell period — matters as much as backup resilience.

What does a ransomware attack really cost?

The cost of an incident goes far beyond any ransom payment. Recovery, downtime, forensics and regulatory exposure typically dwarf the demand itself, which is why prevention and fast recovery are the only sensible economics.

Marks & Spencer disclosed an estimated hit of around £300 million in operating profit and a roughly £750 million drop in market value following its 2025 ransomware attack. Ransom demands themselves keep climbing — UK ransomware payments reportedly ran in the £400,000–£450,000 range in early 2025 (market estimates as of 2026) — but for most businesses the downtime and recovery bill is the bigger number.

Can you recover without paying?

Yes — if you have clean, tested, offline backups. This is the single most important control for surviving an attack that gets through your defences. Businesses with offline backups can restore data without the attacker's key, removing the primary financial leverage and the reason to pay.

Backups address the encryption, but not the double-extortion threat of data publication, so detection and prevention still matter. The practical recipe is three-layered: keep tested offline backups, protect cloud data with a dedicated Microsoft 365 backup, and rehearse recovery as part of a wider business continuity plan. Average recovery from a significant UK incident runs to roughly three weeks — around 21 days on typical UK 2025 figures — far shorter for organisations that have practised it.