How Ransomware Works — The Cybercrime That Shuts Down Hospitals

In May 2021, a ransomware attack forced the Colonial Pipeline, which CyberScoop describes as delivering an estimated 45% of the fuel consumed on the US East Coast, to halt operations. The company paid the attackers $4.4 million in cryptocurrency. In 2019, the city of Baltimore refused a ransom demand of roughly $75,000 and later put the cost of the attack at more than $18 million.

Ransomware works because it attacks the one thing every organization needs: access to its own data. This article walks through each stage, from the first stolen password to the ransom note, explains why the encryption cannot simply be broken, and separates the defenses that work from the ones that only feel reassuring.

What ransomware actually is

Ransomware is malicious software that makes data or systems unusable and then demands payment to restore them. The US Cybersecurity and Infrastructure Security Agency (CISA) defines it as a form of malware designed to encrypt files on a device, after which attackers demand payment for decryption. Older malware tried to hide. Ransomware does the opposite, because the victim's awareness is how the criminal gets paid.

An analogy helps here. Think of a burglar who does not steal your furniture but replaces every lock in your house with one only he can open, then slips a note under the door with a price. Your belongings are all still inside. You simply cannot reach them. The value of the attack comes from how badly you need what is behind the door, not from anything the burglar took.

The idea is old. In 1989, a researcher named Joseph Popp mailed floppy disks labeled as AIDS information to people on a mailing list. The disks carried a program that, after a set number of reboots, hid directories and scrambled file names, and demanded roughly $189 sent to a post office box in Panama. The cryptography was weak and free recovery tools appeared quickly, so the scheme failed as a business. What changed afterward were the two things Popp lacked: unbreakable encryption and a payment method that did not run through a postal box. The latter arrived with cryptocurrency, covered in its own section below. If you want the basics of the money itself, what Bitcoin is and how it works covers the ledger that attackers rely on.

From lone criminals to a service economy

Modern ransomware is a division of labor. Developers write and maintain the malware and run a leak website. Affiliates, who are the people actually breaking into victims, license that toolkit and conduct the attacks. This model is called Ransomware-as-a-Service (RaaS), and it mirrors how legitimate software companies sell subscriptions.

CISA's 2023 advisory on LockBit, then one of the most active RaaS operations, describes exactly this structure: the core group maintains the ransomware and sells access to affiliates who carry out intrusions. CISA reported about 1,700 LockBit attacks in the United States since January 2020, with approximately $91 million in ransoms paid, according to FBI figures. The advisory notes that LockBit affiliates received ransom payments first and then paid the developers their share, the reverse of the arrangement used by some other groups.

The practical effect of RaaS is that a skilled intruder no longer has to write malware, and a malware author no longer has to find victims. Each side does what it is good at, which lowers the barrier to entry and raises the volume of attacks.

How attackers get in

Encryption is the end of an attack, not the beginning. Intruders usually spend days or weeks inside a network first. The entry points are consistent across industry reports, and they are mostly mundane.

Entry route	How it works	Evidence on how common it is
Stolen or weak credentials	Attackers log in through a VPN or remote desktop with a password bought, phished, or guessed	22% of breaches began with credential abuse in the 2025 Verizon Data Breach Investigations Report
Unpatched vulnerabilities	Software flaws in internet-facing systems are exploited before the patch is applied	20% of breaches in the same Verizon report; 32% of ransomware attacks in Sophos's 2025 survey
Phishing and malicious email	A staff member opens an attachment or enters credentials on a fake page	18% of attacks per Sophos (2025), with malicious email accounting for another 19%
Exposed remote access	Remote Desktop Protocol (RDP) or VPN services reachable from the internet	Named by CISA as a leading access route
Supply chain compromise	A trusted vendor's software update delivers the malware	Rare but large in effect, as the Kaseya case below shows

Sources: Verizon 2025 DBIR, Sophos State of Ransomware 2025, CISA #StopRansomware Guide. The percentages come from different surveys with different methods, so they should not be added together.

Stolen passwords and forgotten doors

The Colonial Pipeline intrusion illustrates how ordinary the front door can be. Reporting on the incident says the attackers entered through a compromised password for an inactive VPN account that had no multifactor authentication, a password likely found on the dark web. Nothing exotic was needed. A forgotten account with a single layer of protection was enough.

That is why identity controls rank so high in modern advice. Passwords can be reused, phished, or leaked, while a hardware-backed login cannot be replayed from another machine. Passkeys are built on that idea, and they remove the shared secret that credential theft depends on.

Unpatched software and the WannaCry lesson

On Friday, May 12, 2017, the WannaCry worm spread across the world. It used an exploit called EternalBlue against a flaw in Microsoft's Server Message Block version 1 protocol. Microsoft had published the fix, bulletin MS17-010, on March 14, 2017, about two months earlier.

The UK National Audit Office later investigated the damage to England's National Health Service. It found that at least 81 of 236 hospital trusts were affected, along with 595 GP practices, and that NHS England estimated more than 19,000 appointments were cancelled. The audit noted that all infected organizations shared the same weakness: unpatched or unsupported Windows systems. It also found that no NHS organization paid the ransom, which is a reminder that disruption can be severe even when the money never changes hands.

Patching is dull work and easy to defer. The gap between a fix being published and being installed is exactly the window ransomware affiliates exploit. A related look at the wider threat picture is in cybersecurity threats in 2026.

Phishing and the human element

A phishing email is a forged note from someone you trust. Its goal may be a malicious attachment, a link to a fake login page that harvests credentials, or a request that pushes the recipient to install remote-control software. How social engineering hacking works explains the psychology behind these lures.

Software makers have closed some doors. Starting in 2022, Microsoft began blocking macros in Office files that come from the internet by default, a change it said it made because VBA macros are a common way for malicious actors to deploy malware and ransomware. Attackers responded by shifting to other file types and tricks, which is the standard pattern: every closed door pushes the crowd to the next one.

Supply chain attacks

In July 2021, the REvil gang exploited a zero-day flaw (a vulnerability the vendor does not yet know about), tracked as CVE-2021-30116, in Kaseya's VSA remote management software. Because managed service providers use VSA to administer many customers at once, a single compromise cascaded. ITPro reported that Kaseya estimated roughly 40 customers were directly affected, while the security firm Huntress reported more than 1,000 businesses with encrypted servers and workstations. REvil demanded $70 million for a universal decryptor.

The two counts differ because they measure different things: customers of Kaseya directly versus downstream businesses served by those customers. The lesson is the same either way. Trust relationships are an attack surface.

Inside the attack: from first foothold to ransom note

Once inside, attackers rarely encrypt immediately. Defenders sometimes describe the stages as a chain, because breaking any link stops the finished attack.

1. Foothold. The attacker lands on one machine through one of the routes above.
2. Reconnaissance. They map the network, identify domain controllers (the servers that manage user accounts and permissions), and find where backups live.
3. Privilege escalation. They steal administrator credentials so they can act anywhere.
4. Lateral movement. They spread to other systems, often using legitimate administration tools to blend in.
5. Data theft. They copy sensitive files out of the network, which sets up the second extortion threat covered below.
6. Sabotage of recovery. They delete or encrypt backups and disable security tools.
7. Detonation. They launch the encryption across as many machines as possible at once, often at night or on a weekend when staffing is thin.

Step six is the quiet one that decides how bad the outcome is. A company with intact, separated backups can recover. One whose backups were reachable from the same network, and therefore were destroyed in step six, has far fewer options.

Why attackers wait

The delay is deliberate. A single encrypted laptop is an inconvenience. Encrypted domain controllers, file servers, and backup systems are a crisis. Attackers time the final step to maximize pressure, which is why the ransom note often arrives on a Saturday morning.

The encryption: why you cannot just unlock the files

Ransomware uses the same mathematics that protects online banking, and that is the reason the files cannot usually be recovered without cooperation. The design problem for the criminal is that two kinds of encryption each solve half of the task.

Symmetric encryption, such as AES, uses one key to lock and unlock. It is fast, which matters when you must scramble terabytes before anyone notices. Asymmetric encryption, such as RSA or elliptic-curve schemes, uses a public key to lock and a separate private key to unlock. It is far slower, but it lets a secret be sealed so that only the holder of the private key can open it. A fuller explanation of both is in how encryption works.

Ransomware combines the two in a hybrid scheme. Think of a hotel safe deposit box: the malware locks each file in a quick-turning box using a random symmetric key, then locks that key inside a second box that only the attacker's private key opens. Security researchers analyzing LockBit 2.0, for example, have described random AES keys generated per file and each protected by an embedded RSA public key. The private key stays on the attacker's servers. The victim's machine holds only the sealed result.

This is why the common advice to "just find the decryption key on the computer" fails. The key that unlocks the data was itself locked before the malware finished running. Breaking AES-256 or RSA-2048 by brute force is not feasible with any known technology. Recovery without the attacker's cooperation depends on mistakes, not mathematics: a bug in the malware, a leaked master key, or a law enforcement seizure of the servers.

Partial encryption and speed

To finish faster and slip past detection, many ransomware families now encrypt only parts of each file. A 2025 academic paper on intermittent file encryption describes how attackers encrypt chunks of a file rather than all of it, and shows that this makes the activity harder for detection tools that look at whole-file statistics. The paper, by Ineza and colleagues, found that detectors examining small localized sections of a file outperformed those that examined whole files.

A partially encrypted file is still ruined. A damaged database or a video missing every tenth block cannot be opened normally, so speed gains cost the attacker nothing.

What else the malware does

Beyond encrypting, typical ransomware also:

• Deletes Windows Volume Shadow Copies, the operating system's built-in snapshot backups, so users cannot roll back
• Terminates database and backup programs that hold files open, so they can be encrypted
• Targets network shares, network-attached storage, and virtual machine files
• Disables or tampers with antivirus and monitoring tools

CISA's description of LockBit 3.0 notes that affiliates can encrypt Windows and Linux devices as well as VMware virtual machine instances, which matters because one hypervisor (the software that hosts virtual machines) can hold dozens of servers.

The ransom note and the money

After encryption, the malware displays a note and often changes the desktop wallpaper. The note directs the victim to a chat portal, usually on the Tor network (software that hides the location of a website's server), where an operator negotiates and supplies a payment address.

Cryptocurrency is the payment rail because it moves across borders without a bank. Bitcoin's ledger is public, though, so every payment is permanently visible even if the owner's identity is not. That visibility is what let US investigators track the Colonial Pipeline payment. The Justice Department announced on June 7, 2021, that it had seized 63.7 bitcoin, valued at about $2.3 million, which it traced to the DarkSide ransom payment. The seizure was possible because the FBI held the private key to the address the funds had moved into, and how it obtained that key was not publicly explained.

The money story has shifted since then. Blockchain analytics firm Chainalysis estimated that ransomware victims paid about $1.25 billion in 2023, a record, and about $813.55 million in 2024, a 35% fall. Reporting on the Chainalysis findings attributes the decline to law enforcement operations, harder money laundering after crackdowns on exchanges and mixers, and more victims declining to pay and restoring from backups.

What do victims actually pay?

Figures vary because they come from different samples. Two widely cited ones:

Measure	Figure	Source
Median ransom paid	$115,000 (2024 incidents)	Verizon 2025 DBIR
Victims who did not pay	64%	Verizon 2025 DBIR
Organizations that paid and got data back	49%, down from 56% a year earlier	Sophos 2025
Average payment relative to initial demand	85%	Sophos 2025
Mean recovery cost, excluding ransom	$1.53 million	Sophos 2025

Sophos's survey covered 3,400 IT and security leaders in 17 countries, all at organizations hit by ransomware in the prior year. Verizon's dataset covered more than 22,000 security incidents, including 12,195 confirmed breaches. The recovery figure is worth pausing on: for the surveyed organizations, the cost of rebuilding systems, on average, was larger than the typical ransom.

Double extortion: why backups no longer end the story

For years the standard answer to ransomware was "keep good backups." In November 2019, the Maze group changed the calculation. Check Point Research describes an attack on the security staffing company Allied Universal in which the attackers demanded 300 bitcoin (about $2.3 million), published a sample of stolen files, including contracts and medical records, and later escalated when the victim refused. Check Point framed this as a new trend that took hold in early 2020: copy the data before encrypting it, then threaten to publish it.

That is double extortion. The victim now faces two separate problems. Encryption is solved by backups. Publication is not, because once data is stolen no restore procedure can un-steal it. The threat of regulatory penalties, lawsuits, and damaged trust can pressure a victim into paying even when its systems are fully recovered. Some groups go further, threatening denial-of-service attacks or contacting a victim's customers directly. CISA's LockBit advisory confirms that affiliates use double extortion routinely.

There is a weakness in the criminals' side of the bargain, and the 2024 numbers reflect it. Paying does not guarantee the data is deleted. BleepingComputer's coverage of the Chainalysis report cites victims' distrust of attackers' promises to delete stolen data as one reason payments fell.

The Change Healthcare case

The scale of what a data-theft attack can expose became clear in 2024. In February of that year, the ALPHV (BlackCat) group attacked Change Healthcare, a major US healthcare payments processor owned by UnitedHealth Group. Healthcare Dive reported that UnitedHealth's chief executive confirmed the company paid a $22 million ransom in Bitcoin, that the company said data on about 190 million people may have been compromised, and that UnitedHealth spent $3.1 billion responding in 2024. Paying did not end the exposure. The company's own estimate of the number of affected people nearly doubled from an earlier figure of 100 million. For readers who want a broader view of attacks on healthcare, the same pattern appears across the sector: patient data is valuable, and downtime is dangerous.

When ransomware hits hospitals

Hospitals are attractive targets for a simple reason. They cannot afford to be offline, so the pressure to restore quickly is intense.

In September 2020, ransomware hit Düsseldorf University Hospital in Germany. MIT Technology Review reported that German authorities said the attackers exploited a Citrix VPN vulnerability publicly known since January that the hospital had not fixed. A woman needing urgent care was diverted to a hospital about 30 kilometers (19 miles) away, and police opened a negligent homicide investigation, with early coverage describing it as potentially the first death linked to a cyberattack.

That framing did not survive the full investigation. A later account of the prosecutor's findings, as reported by Wired and summarized by the German outlet Borncity, said the investigation was closed because no causal link was found between the attack and the death. After an autopsy and expert review, the prosecutor concluded that the patient's condition was so severe she would have died whichever hospital she reached. The widely repeated line that ransomware killed a patient in Düsseldorf is therefore not supported by the final investigation.

The Düsseldorf case remains instructive for a different reason. Even without a proven death, hospitals diverting ambulances, canceling surgeries, and falling back to paper records show how ransomware turns an IT incident into a patient-safety problem. The WannaCry figures above tell the same story at national scale.

Who is responsible: the law and the ethics of paying

Law enforcement agencies generally advise against paying, because payments fund further attacks and do not guarantee recovery. The data bear out the second half. Sophos found that fewer than half of surveyed victims paid and got their data back, and Sophos's own recovery-cost figure shows that even a successful payment is only part of the bill.

Paying can also carry legal risk. In September 2021, the US Treasury's Office of Foreign Assets Control (OFAC) issued an updated advisory on the sanctions risks of facilitating ransomware payments and, in the same action, sanctioned the Russia-based cryptocurrency exchange Suex. Legal commentary on the advisory says a person subject to US jurisdiction can face civil liability for a sanctioned payment even without knowing the recipient was sanctioned, and that good cybersecurity practices and prompt reporting to law enforcement may count in an organization's favor. Organizations weighing a payment should take legal advice first, and that is not a decision this article can make for anyone.

Law enforcement wins, and their limits

Enforcement has had real successes. In February 2024, the UK's National Crime Agency led Operation Cronos against LockBit, with partners including the FBI and Europol. Help Net Security's account lists control of LockBit's administration environment and leak site, 34 servers across eight countries, more than 200 cryptocurrency accounts, and the group's source code. Authorities said they had more than 1,000 decryption keys, and decryption tools were released free through the No More Ransom portal. Two LockBit actors were arrested in Poland and Ukraine, and two Russian nationals were indicted.

Reporting differs on details such as whether 28 or 34 servers were seized, which is common in fast-moving cases. What is consistent is the effect: the Chainalysis analysis names Operation Cronos among the reasons for the 2024 decline in payments. Takedowns do not end ransomware, though. Operators who lose one brand often reappear under another, and affiliates move between groups.

What actually works as defense

Ransomware defense is not mysterious. The controls that matter map directly onto the attack chain above, and CISA's guide recommends all of them. The honest framing is that no single control is sufficient, and layers matter because attackers only need one gap.

Control	Which attack stage it interrupts	Why it works
Offline or immutable backups, tested regularly	Recovery sabotage, detonation	Encryption cannot reach a copy the network cannot touch, and tested restores prove it
Multifactor authentication, ideally phishing-resistant	Foothold, privilege escalation	A stolen password alone no longer opens the door
Patching internet-facing systems first	Foothold	Closes the exact flaws affiliates scan for
No direct internet exposure for RDP	Foothold	Removes a common brute-force target; CISA advises compensating controls and MFA if exposure is unavoidable
Network segmentation	Lateral movement	A breach in one department cannot reach finance or backups
Least privilege and separate admin accounts	Privilege escalation	Limits what a stolen account can do
Endpoint detection and response	Lateral movement, detonation	Flags behavior such as mass file changes and shadow copy deletion
Email filtering and user training	Foothold	Reduces the volume of lures that reach people
An incident response plan, rehearsed	All stages	Decisions made calmly beat decisions made at 3 a.m.

The 3-2-1 backup rule, and why it needs a fourth number

The classic backup rule is 3-2-1: three copies of data, on two kinds of storage, with one copy offsite. For ransomware the crucial property is that at least one copy must be unreachable from the production network, either physically disconnected or locked so it cannot be changed (immutable storage). Cloud backups that share credentials with the main network can be deleted by an attacker who owns the administrator account. For a primer on where those copies often live, see how cloud computing works.

Backups also fail quietly. A backup that has never been restored is a hope, not a plan. Several organizations in the Sophos survey found their backup route unavailable or incomplete, and the report notes recovery through backups hit its lowest rate in six years.

Detection beats prevention alone

Because prevention will sometimes fail, the time between foothold and detonation is the defender's best opportunity. Behavioral tools that spot a process suddenly rewriting thousands of files, or deleting shadow copies, can stop an attack mid-run. Machine learning is used here to find unusual patterns, and machine learning in cybersecurity covers how those detectors work and where they struggle.

A VPN is not a ransomware defense on its own, though it can reduce exposure when it replaces open RDP and is itself protected with multifactor authentication. How a VPN works explains the tunnel and its limits.

Common misconceptions

"Ransomware only targets big companies." Verizon's 2025 report found ransomware in 44% of breaches overall, and an IDC analyst quoted in Verizon's announcement said it appeared in 88% of breaches at small and medium-sized businesses. Small organizations are less likely to have dedicated security staff and are often reached through the same remote-access mistakes as large ones.

"Antivirus will stop it." Traditional signature-based antivirus recognizes known malware. Ransomware authors rebuild their programs constantly so the signature changes. Modern endpoint tools use behavior as well, which helps, but even they are not a guarantee.

"If I pay, I get everything back." The Sophos figures show fewer than half of organizations that were hit paid and recovered data, and that those who paid typically paid about 85% of the initial demand. Even a working decryptor is often slow and imperfect, and does nothing about stolen data.

"The attack happens the moment someone clicks." Often it does not. Many incidents involve a long dwell time in which the attacker explores quietly. This is good news for defenders, because it means there is a window to detect them.

"Encryption is military-grade, so nothing can be done." The cryptography is sound. The weak points are everywhere around it: access, patching, backups, and detection. Defenders win by fixing those, not by attacking the mathematics.

What this means

Ransomware is less a technical marvel than an economic one. The cryptography is standard, borrowed from the same toolbox that secures online banking, and the entry methods are mostly old: reused passwords, delayed patches, a forgotten VPN account. What makes the attacks pay is the business model around them, including affiliates who specialize, leak sites that add a second threat, and payment rails that cross borders.

That framing points to the defense. The 2024 decline in payments, tracked by Chainalysis, did not come from a breakthrough in cryptography. It came from more victims who could restore from backups, tougher action against the exchanges that launder proceeds, and takedowns of major groups. Each of those raises the cost of the crime or lowers its return. The same logic works at the scale of a single organization: make intrusion harder, make recovery boring, and make stolen data less valuable by limiting what is stored. A system that can restore itself on an ordinary Tuesday gives attackers less to bargain with.

Sources

• CISA, #StopRansomware Guide
• CISA Advisory AA23-165A, LockBit 3.0
• Verizon, 2025 Data Breach Investigations Report
• Sophos, The State of Ransomware 2025
• UK National Audit Office, Investigation: WannaCry cyber attack and the NHS
• Microsoft Security Bulletin MS17-010
• CyberScoop, DOJ seizure of Colonial Pipeline ransom proceeds
• BleepingComputer, Ransomware payments fell by 35% in 2024 (Chainalysis)
• Check Point Research, Ransomware evolved: double extortion
• Healthcare Dive, Change Healthcare cyberattack
• Help Net Security, LockBit takedown

Key Takeaways

• Ransomware pairs fast symmetric encryption with a public-key-wrapped key, so files cannot be unlocked without the attacker's private key
• Entry is usually mundane: stolen credentials, unpatched software, phishing, or exposed remote access
• Attackers often spend days inside a network first, destroying backups and stealing data before they encrypt
• Double extortion, first widely noted in late 2019, means restoring from backup does not stop the data-leak threat
• Payments fell about 35% in 2024 to roughly $813.55 million, according to Chainalysis, as more victims refused to pay
• Tested offline backups, multifactor authentication, prompt patching, and segmentation address the real attack chain

FAQ

Q: How does ransomware spread through a network? A: After gaining a foothold, attackers steal administrator credentials and move from machine to machine, often using legitimate administration tools so their activity looks routine. They typically find backup systems first and disable them, then launch encryption on many machines at once. Some worms, such as WannaCry, spread automatically by exploiting a software flaw.

Q: Can encrypted files be decrypted without paying? A: Usually not, unless something goes wrong for the attacker. Recovery is possible when the malware has a flaw, when law enforcement seizes the attackers' servers and obtains keys, or when a clean backup exists. In the LockBit takedown, authorities said they had obtained more than 1,000 decryption keys and released free tools through the No More Ransom portal.

Q: What is the difference between ransomware and a virus? A: A virus is defined by how it replicates, by inserting itself into other programs. Ransomware is defined by its goal, which is extortion. Ransomware can spread in several ways: some families self-propagate like a worm, while others are deployed by hand by an intruder who already controls the network.

Q: Is it illegal to pay a ransom? A: Not always, but it can be. In the United States, OFAC's September 2021 advisory warns that paying a sanctioned person or group may violate sanctions law, and commentary on the advisory says liability can apply even without knowledge. Organizations should consult legal counsel and consider notifying law enforcement before any payment.

Q: Why do ransomware groups demand cryptocurrency? A: It moves across borders without a bank and without a traditional account holder. It is not anonymous, though. Bitcoin transactions are recorded on a public ledger, which is how US investigators traced the Colonial Pipeline payment and seized 63.7 bitcoin, valued at about $2.3 million, in June 2021.

Q: What happened to the Colonial Pipeline ransom? A: The company paid about $4.4 million in cryptocurrency to the DarkSide group in May 2021. The Justice Department announced on June 7, 2021, that it had seized about $2.3 million worth of the bitcoin, after obtaining the private key to the wallet the funds had been moved to. The method used to obtain the key was not disclosed.

Q: Does paying guarantee my data will be deleted? A: No. Sophos's 2025 survey found that only 49% of surveyed organizations paid and got their data back, and analysts cite victims' distrust of attackers' promises to delete stolen data as one reason payments fell in 2024. Stolen data can be sold, leaked, or reused even after a payment.

---

Read next:

• How Facial Recognition Works: From Pixels to Face Embeddings
• What Is Cybersecurity? The Basics Everyone Should Know
• Countries With the Most Cybercrime Activity