How do ransomware attacks typically get in?

Common entry routes include phishing emails with malicious attachments or links, compromised accounts, and unpatched software.

Why don't backups alone solve the ransomware problem anymore?

Many attackers now steal data before encrypting it and threaten to publish it, so restoring your files does not end the problem because the attacker's copy still exists.

How should backups be stored to protect against ransomware?

Store at least one copy offline or disconnected from your main system so ransomware cannot reach and encrypt it, and test restoring from it occasionally.

Why is patching important for ransomware prevention?

Unpatched software is a common entry route for ransomware, so one forgotten update can be enough for an attack to succeed.

How Ransomware Works and Prevention: TechCity Walkthrough

A recent TechCity explainer opens with a scene many people dread: you sit down at your computer and your documents will not open. Your photos carry unfamiliar file extensions. A message demands payment to restore your files. For a business, the problem is bigger, because staff may lose access to the systems they need to work. This post walks through how ransomware works and prevention steps that make a real difference, including an honest look at what a VPN can and cannot do.

How Ransomware Works and Prevention: The Attack Step by Step

Ransomware is malicious software that locks your files, usually by encrypting them, and then demands payment. Most attacks follow a similar sequence, even though the details vary.

Entry. The malware needs a way in. Common routes include phishing emails with malicious attachments or links, compromised accounts, and unpatched software. One careless click or one forgotten update can be enough.
Spreading. Once inside, the malware or the attacker looks for more to lock. On a home computer that may mean local documents and photos. In an office it can mean shared drives and other connected machines.
Encryption. Files are scrambled so they cannot be opened without a key. This is the stage the TechCity piece describes: files that will not open and strange new extensions.
The demand. A ransom note appears, asking for payment in exchange for restoring access.

Understanding this sequence matters because each step is a chance to stop the attack. Blocking entry, limiting spread, and keeping recoverable copies all break the chain at different points.

Why Backups Alone No Longer End the Extortion

For years the standard advice was simple: keep backups and you can ignore the ransom note. Backups are still essential, but the picture has become more complicated. Many attackers now steal data before encrypting it, then threaten to publish it. That means restoring your files does not necessarily end the problem, because the copy the attacker took still exists.

Our explainer on double extortion ransomware and why backups fall short covers this in depth. Related reporting on why ransomware protection needs more than backups makes the same point: a modern defense has to address data theft as well as data loss. Backups answer the question of recovery. They do not answer the question of exposure.

Defenses That Actually Work for Individuals and Small Businesses

The good news is that the most effective defenses are not exotic. They are habits and settings that reduce the odds of entry and limit the damage if something slips through.

Keep offline or isolated backups. Store at least one copy disconnected from your main system, so ransomware cannot reach and encrypt it. Test restoring from it occasionally.
Patch promptly. Install updates for your operating system, browsers, and apps. Unpatched software is a common way in.
Learn to spot phishing. Be wary of unexpected attachments, urgent requests, and links that do not match the sender. When in doubt, verify through a separate channel.
Use least-privilege access. Give people and accounts only the access they need. If one account is compromised, the attacker reaches less.
Turn on multi-factor authentication. A stolen password alone should not be enough to get into your accounts.
Have a plan. Know who to call and what to disconnect if something goes wrong. For a closer look at the time pressure attackers try to create, see our guide on protecting against ransomware's 72-hour threat.

Small businesses often assume they are too small to be targeted. Attackers frequently rely on automation and opportunity, so basic hygiene matters at every size.

What a VPN Can and Cannot Do Against Ransomware

VPNs are often mentioned in security conversations, so it is worth being precise. A VPN encrypts your internet traffic between your device and the VPN server and hides your IP address from the sites you visit. That is useful on public Wi-Fi and for privacy.

What a VPN does not do is stop ransomware. It does not scan attachments, block a malicious file you choose to open, patch vulnerable software, or protect you from a phishing email once you click. If ransomware is already on your device, a VPN will not decrypt your files or remove the malware. Some security products bundle extras such as malicious-site blocking, but that is a separate feature from the VPN tunnel itself, and you should check what any tool actually does.

Think of a VPN as one layer of privacy protection, not a ransomware defense. Relying on it for this purpose would leave the main entry points open.

What This Means For You

Ransomware is a practical problem with practical answers. Whether you are protecting family photos or a company file server, the steps that matter most are the same: keep recoverable copies offline, stay updated, treat unexpected messages with suspicion, and restrict access. Attackers are also evolving their methods, and reporting on how reputation has become a weapon in ransomware data extortion shows why protecting data from theft deserves attention alongside recovery.