How ransomware works
Attackers gain access through phishing, stolen credentials, exposed remote services or unpatched software. They explore the network, escalate privileges, disable backups and security tools, and often exfiltrate data before launching the encryption across many systems at once.
Victims then receive a ransom note with payment instructions. This double extortion model means that restoring from backups may not remove the threat, because stolen data can still be leaked or sold. Some groups now target backup systems and cloud storage as well.
Why it matters for Canadian organizations
Ransomware affects Canadian hospitals, municipalities, schools and businesses of all sizes. The Canadian Centre for Cyber Security identifies it as a persistent threat to Canadian organizations, and an attack that exposes personal information triggers breach reporting under PIPEDA or Law 25.
Beyond ransom, costs include downtime, recovery, legal advice and lost trust. Cyber insurers now ask detailed questions about controls such as multi-factor authentication, backups and endpoint detection before offering cover. Preparation, including a tested response plan and contact list, is far cheaper than improvising during an attack.
How to defend against it
Reduce likelihood with multi-factor authentication, prompt patching, secure remote access, email filtering and least privilege. Maintain offline or immutable backups and test restores regularly, since backups are the main route to recovery.
Improve detection and response with endpoint detection, 24/7 monitoring and a practised incident response plan. Segment networks to limit spread, and agree in advance who decides on engagement with law enforcement and the Canadian Centre for Cyber Security. Report incidents promptly to the Canadian Centre for Cyber Security and local police as appropriate.
Frequently asked questions
Should you pay a ransomware demand?
Authorities generally advise against paying, as it does not guarantee data recovery and encourages further attacks. Decisions involve legal, insurance and law enforcement advice, so plan before an incident occurs. Never rely on a promise that paying restores everything.
How does ransomware spread?
Typically via phishing emails, stolen or weak credentials, exposed remote desktop or VPN services, and unpatched vulnerabilities. Once inside, it spreads using network shares and administrative tools. Reducing exposed services and enabling MFA closes the common doors.
Can backups protect against ransomware?
Yes, if they are isolated, immutable or offline and tested. Attackers often target backups first. Backups do not prevent data theft, so detection and access controls are still needed. Immutable backups cannot be altered by attackers, even with administrator access.
Related service: Cyber defense