Ransomware
ransomware attack · RaaS · ransomware as a service · double extortion · crypto-ransomware · rançongiciel
Malware that encrypts an organisation’s data and demands a ransom to restore it, often also threatening to publish the stolen data.
In practice
Ransomware gangs operate like businesses: developers rent out their tooling to affiliates who break into networks (stolen credentials, a VPN flaw, phishing). Before encrypting anything, they steal data and destroy any backups they can reach: this is double extortion. Paying guarantees neither decryption nor silence, funds organised crime and marks you as a payer for future attacks; French authorities advise against it.
On the night of 20 to 21 August 2022, the Centre Hospitalier Sud Francilien in Corbeil-Essonnes, south of Paris, was crippled by ransomware: emergency plan triggered, patients redirected, medical imaging unavailable. The hospital refused to pay, and the attackers published part of the stolen data in September.
How to protect yourself
- 3-2-1 backups, including one offline copy, with restores that are actually tested.
- Multi-factor authentication on remote access, email and administrator accounts.
- Fast patching of internet-facing equipment: VPNs, firewalls, mail servers.
- A written, rehearsed response plan. If hit: isolate without powering off, do not pay, and report to the police (within 72 hours to remain eligible for cyber insurance cover under French law).
