Ransomware: how it really works (and why backup is your only insurance)
October is European Cybersecurity Month: a month dedicated to digital hygiene. Ransomware is its most misunderstood topic. People picture it as something that only hits hospitals and large corporations. In reality, it encrypts family holiday photos just as readily as a craftsman's quotes. Here is how it works, how to protect yourself, and why only one thing lets you recover without paying: a disconnected backup.
1. The scene nobody imagines
An ordinary Tuesday evening. You open an email that looks like an invoice — familiar logo, urgent tone, attachment. You click. Nothing happens, or so it seems. The next day, your files have a strange extension. Your photos won't open. A text file has appeared on your desktop:
"Your files have been encrypted. To recover them, send bitcoin before Friday. After that deadline, the key will be destroyed — or your data will be published."
No spectacular virus, no flashing red screen. Just your memories and documents, unreadable, and a countdown.
This scenario is not a movie. It is the standard ransomware playbook in 2026, hitting individuals and very small businesses every day through the same vector in the vast majority of cases: a phishing email and a click.
2. How it actually works
Ransomware is software that makes your files unreadable, then demands payment for the decryption key. The mechanics come down to four steps:
1. Entry. Most often a booby-trapped email (fake invoice, fake parcel, fake tech support), sometimes a malicious Office attachment or link. For businesses, it can also be a poorly protected remote access — a desktop exposed to the internet with a weak password.
2. Silent installation. Once opened, the program installs itself with no visible sign. Modern variants first disable local automatic backups and look for anything plugged in: external hard drive, USB stick, shared folders on the home or small-office network.
This is the crucial point most people miss: an external drive left permanently plugged in gets encrypted along with everything else. It stops being a backup at the very moment you need it.
3. Encryption. The program encrypts your documents, photos and videos with strong algorithms (AES/RSA type — the same ones that protect your online banking, here turned against you). Without the attackers' key, decrypting them yourself is wishful thinking.
4. Double extortion. For several years now, groups no longer just encrypt: they steal a copy of your data before encrypting it, then threaten to publish it. You pay to regain access and to prevent the leak. For an individual, that means intimate photos or ID documents. For a freelancer or tradesperson, it means client data — with legal liability on top.
Behind it all sits an industry: "ransomware-as-a-service". Developers rent their software to affiliates for a cut, like a crime franchise. That is what makes attacks so massive: you no longer need to be a genius to launch one, you just need to be a customer.
3. "I'm not a target" — yes, you are
That is the most dangerous misconception. Attackers don't pick you out, they spray widely — and they spray with ever-better aim.
Individuals are targeted opportunistically, with increasingly fresh data. In recent months, data breaches at French companies have kept coming: names, email addresses, phone numbers, sometimes passwords or customer records end up in circulation. For attackers, that is qualified, recent raw material. Gone is the generic typo-ridden email: today's phishing calls you by name, cites your telecom provider, your bank or your insurer, and quotes your real order references. The trap's credibility comes straight from those breaches — and it will only grow as long as everyone reuses the same password everywhere.
In practice, the ransom demanded from an individual is "calibrated": a few hundred euros, enough to hurt, not enough to call the police — or so they hope.
Very small businesses, tradespeople, freelancers and non-profits are over-represented among victims who report their cases — Cybermalveillance.gouv.fr, the French public victim-assistance platform, observes this year after year in its reports. The logic is relentless: these organisations hold vital data (accounts, clients, site photos, patient files) but rarely have a dedicated IT person, tracked updates or a tested backup.
Nobody is "too small to be attacked". Attacks are automated and fuelled by your own stolen data; your size doesn't protect you, your hygiene does.
4. Prevention that actually works
No expertise required. France's ANSSI — the national cybersecurity agency — repeats it in every one of its guides: four reflexes eliminate most of the risk.
Update, fast. Operating system, browser, apps, internet router. Most intrusions exploit vulnerabilities patched months ago. Enable automatic updates everywhere possible.
Treat every urgent email as suspect. "Overdue invoice", "parcel held", "your account will be suspended": check the sender's real address, hover over links without clicking, and when in doubt go directly to the official website instead of clicking in the email. No serious administration or provider asks you to open an attachment under threat. And if the email quotes exact personal details, remember the previous point: they probably come from a breach, not a real adviser.
Enable two-factor authentication (2FA) and stop reusing passwords. Email, cloud, banking, social networks: even if your password leaks — and given the pace of breaches, assume it already has — the second factor stops the intruder. Use a password manager for a unique password per site.
Unplug your backup drive. The least-known and most important reflex: once the copy is done, unplug the external drive and put it away. Left permanently connected, it is not a backup, just a second victim. Same logic at the office: a backup always connected to the network is not one.
5. Why backup is your only insurance
Against solid encryption, there are only two outcomes: paying (with zero guarantee — the key sometimes never arrives, and paying flags you as a "good payer" for next time) or restoring from a clean copy that was disconnected at the time of the attack.
That is exactly the 3-2-1 rule we detailed here: 3 copies, 2 different media, 1 offsite copy. Ransomware is the absurd demonstration of each number:
- 3 copies, because the main machine and the plugged-in drive can fall together.
- 2 different media, because a single failure type — here logical encryption — must not take everything.
- 1 offsite copy, because what sits elsewhere, disconnected, cannot be encrypted remotely.
The often-forgotten link is version history: a good cloud service keeps your previous versions for several weeks. If an encrypted version accidentally syncs to the cloud, you can roll back to the healthy pre-attack version. That is the case with Archibou, which keeps 30 days of history — but the point holds for any serious provider offering it: check this before choosing.
In practice, for a family: the computer + an external drive unplugged after copying + an offsite cloud copy. For a freelancer: the same, plus backing up the phone, often forgotten even though it holds quotes, invoices and site photos.
6. If it's already too late
Stay calm and proceed in order:
- Disconnect the device from the internet and the local network (cable, Wi-Fi). Don't necessarily switch it off — some investigation-useful traces live in memory — but isolate it to stop the spread to other devices.
- Don't pay in a rush. Paying funds the industry attacking you, guarantees nothing, and the stolen data may still end up published.
- Get free help: Cybermalveillance.gouv.fr guides you step by step by profile (individual, business, local authority) and points you to nearby support providers. The ANSSI guides are a useful complement for rebuild best practices.
- File a complaint (police station, gendarmerie, or online pre-complaint) and keep the ransom note plus one encrypted file sample.
- Rebuild on clean foundations: reinstall the system from official media, change passwords from a healthy device, then restore your files from your disconnected copy or version history — never from media that stayed plugged in during the attack.
Conclusion: you don't negotiate with encryption, you sidestep it
Ransomware thrives on two illusions: "it only happens to others" and "my external drive protects me". Reality is simpler and more reassuring: with up-to-date updates, suspicion toward urgent emails — however well-informed —, unique passwords, and above all a genuine 3-2-1 backup including a disconnected offsite copy, you remove the attackers' only leverage.
That is the philosophy we apply at Archibou: your files hosted in France, never scanned nor resold, with 30 days of history to roll back — to be that offsite copy you can count on the day everything else is encrypted.
And you: if your screen displayed that message tomorrow morning, where would you restore your photos from?