Ransomware: understanding, preventing and responding to an attack

Ransomware is malicious software that encrypts a victim's data and systems to demand a ransom, usually after stealing that data so as to threaten to publish it. Hospitals, local authorities, manufacturers, small businesses: no organisation is too small to be targeted. This article explains how an attack unfolds, how to prevent it and what to do if it happens, with a focus on the French framework. For the specific case of intrusions through VPNs and firewalls, see our news article on edge devices as the main way in.

The word combines ransom and software. The principle is old: make data unusable by encrypting it, then sell the decryption key. What has changed is how attackers are organised.

Attacks no longer just target random individuals. Since 2020, CERT-FR, the French government computer emergency response team, has described "big game hunting": groups that target companies and institutions able to pay a lot, and take the time to prepare. Many operate as ransomware as a service: one group develops the software and rents it to affiliates, who carry out intrusions and share the proceeds. Other players specialise in selling access to networks already compromised.

In France, 128 ransomware compromises were reported to ANSSI, the national cybersecurity agency, in 2025, according to its threat landscape report. The figure only counts cases reported to the agency. The same report notes that some attackers are moving away from encryption towards pure data theft followed by a threat to publish.

A targeted attack is not instantaneous. ANSSI's ransomware guide describes a progression in several stages, which may take days or weeks between intrusion and encryption. That delay is an opportunity: each stage leaves traces, and each has its countermeasure.

Backups were long the ultimate defence: if you can restore everything, why pay? Attackers responded with double extortion. CERT-FR dates it to late 2019: before encrypting, they steal the data, then threaten to publish it on a leak site if the victim does not pay. Even an organisation that restores everything remains exposed to blackmail.

According to the 2025 report, attackers still practise double or even triple extortion, adding further pressure such as denial-of-service attacks or contacting the victim's customers and partners directly. A ransomware attack is therefore almost always a data breach too, with the obligations that follow (see below). Our articles on a hospital cyberattack sanctioned by the CNIL and on data leaks in the French State show the consequences.

ANSSI's guide makes backups the top priority while stressing that they are not enough. The essential measures, in the order of the attack stages:

• Reduce the attack surface: inventory what is exposed to the internet, patch quickly, starting with edge devices, and enforce multi-factor authentication on all remote access and administrator accounts.
• Detect: up-to-date antivirus, preferably an endpoint detection and response tool on workstations and servers, with centralised logs that someone actually reviews.
• Slow the spread: segment the network, limit user rights, separate administrator accounts from everyday accounts, protect the directory.
• Protect backups: at least one offline or immutable copy, taken regularly, and tested restores. A backup you have never restored is only a hypothesis.
• Prepare for the crisis: a crisis management plan and a disaster recovery plan known to management, printed emergency contacts, an exercise at least once a year.
• Train users to recognise phishing and report suspicious behaviour quickly.

These measures make full sense when they answer an explicit risk scenario. Ransomware is top of the list in any risk analysis, and its impact is measured in the business impact analysis of your business continuity plan: how long can you operate without a given system?

The first hours count. The Cybermalveillance.gouv.fr checklist, from the French government victim assistance service, and ANSSI's guide agree on these steps:

1. Isolate without switching off: disconnect affected machines from the network (cable, Wi-Fi), but do not shut them down unless encryption is still running: their memory holds traces useful to investigators.
2. Protect backups: disconnect them from the network immediately so they are not encrypted in turn.
3. Raise the alarm: your IT team or provider, then an incident response specialist. In France, the 17Cyber platform, launched in December 2024 by the police, the gendarmerie and Cybermalveillance.gouv.fr, guides victims and connects them with providers.
4. Set up a crisis team with management, and keep a log: a dated record of everything observed and decided.
5. Preserve evidence: ransom note, encrypted files, logs. Do not reinstall anything before filing a complaint.
6. Communicate internally and, where needed, with customers and partners, through a safe channel: your usual email may be compromised.

ISO 27035 structures this response in phases, from detection to lessons learned: see our article on security incident management.

ANSSI and Cybermalveillance.gouv.fr are consistent: do not pay. Three reasons:

• Nothing is guaranteed: the key may not work, or only partly, and restoring takes time anyway.
• Paying does not undo the theft: nothing stops the attacker from publishing or reselling the exfiltrated data, or coming back.
• Paying funds the next attacks and marks you as a target that pays.

Under French law, paying is not banned as such. The law of 24 January 2023 on the Ministry of the Interior regulated it on the insurance side: under Article L12-10-1 of the Insurance Code, cover for losses caused by a cyberattack only applies if the victim filed a complaint no later than 72 hours after becoming aware of the attack. Before any decision, also check whether a free decryption tool exists on No More Ransom, backed by Europol.

Restarting too fast is a common mistake: if the attacker left a backdoor or the directory is still compromised, they will be back. Rebuilding usually follows this order: understand how the attacker got in and what they touched, rebuild a trusted core (directory, administrator accounts, renewed passwords and secrets), restore from clean backups, then bring services back by business priority, following your recovery plan.

Then comes the post-incident review: what allowed the intrusion, what delayed it or could have stopped it, how long did each response step take? Its findings feed the risk analysis, the action plan and the security policy. Think about your suppliers too: a compromised provider can be the source of the attack or suffer its effects, hence the value of third-party risk management.

To build the ransomware scenario into your risk analysis and track the resulting measures, see our risk analysis module.