Ransomware

Ransomware (extortion software) is a form of malware that, after infecting a system, deliberately encrypts files, storage media or entire IT environments and denies legitimate users access. In return for decryption, the attackers demand a ransom, usually in cryptocurrency. A widespread variant today is so-called double extortion: before encryption, data is exfiltrated and the publication of the stolen information is threatened as additional leverage. For years, the German Federal Office for Information Security (BSI) has rated ransomware as one of the greatest threats to the information security of businesses and public administration.

Typical entry points include phishing emails with malicious attachments or links, unpatched vulnerabilities in publicly accessible services, compromised credentials, and inadequately secured remote access such as RDP or VPN. After initial access, attackers often move laterally through the network, escalate privileges and disable backups before triggering the actual encryption. Effective countermeasures therefore require a layered approach combining patch and vulnerability management, network segmentation, multi-factor authentication and the least-privilege principle, together with tested, offline or immutable backups following the 3-2-1 rule.

From a legal perspective, a ransomware incident touches several sets of obligations. Operators of critical infrastructure and essential as well as important entities within the meaning of the NIS2 Directive are subject to risk-management and reporting duties; a significant incident must be reported within 24 hours as an early warning and in more detail within 72 hours. Where personal data is affected, the obligations under Articles 33 and 34 GDPR additionally apply. The BSI and law enforcement authorities explicitly advise against paying a ransom, since recovery is not guaranteed and payments finance the criminal business model.