Ransomware on Personal Devices: What Actually Happens to Your Files

How Ransomware Reaches Your Device

Ransomware doesn't need a sophisticated hacking operation to land on a personal device. The most common delivery method is a phishing email — a message designed to look legitimate that carries either a malicious attachment or a link to a compromised website. Opening the attachment or clicking the link triggers the malware installer.

Other common entry points include:

• Malicious downloads: Pirated software, cracked games, or unofficial app installers that bundle ransomware alongside the promised file.
• Drive-by downloads: Visiting a website hosting exploit kits that target unpatched browsers or plugins — no file download required on your part.
• Removable media: Infected USB drives, though less common today, remain a real vector.

Connecting to untrusted networks can also increase exposure. Our article on public Wi-Fi security risks covers how network-level attacks can create opportunities for malware delivery. Understanding your device's broader security posture matters — see our device security hub for a full overview.

What Ransomware Does Once It's Running

Once executed, ransomware moves quickly and methodically. Here's what typically happens in sequence:

1. Persistence: The malware embeds itself in your system startup processes so it survives a reboot.
2. Reconnaissance: It scans your local drives and any connected external drives or mapped network folders for files worth encrypting — documents, photos, videos, spreadsheets, and databases are priority targets.
3. Key exchange: The ransomware contacts the attacker's command-and-control server to receive or register an encryption key unique to your infection.
4. Encryption: Each targeted file is encrypted and often renamed with a new extension (e.g., .locked or .crypt). The originals are deleted.
5. Ransom note: A text file or pop-up window is dropped on your desktop explaining what happened and providing payment instructions, usually demanding cryptocurrency.

The entire encryption phase can complete in minutes. By the time most users notice anything unusual, the damage is already done. This is why understanding your device's own encryption features matters — it clarifies what the OS protects and what it doesn't.

Your Realistic Options After an Infection

If ransomware has run on your device, your options depend almost entirely on whether you have usable backups.

If you have clean, recent backups

Your best path is to wipe the device completely — a full reinstall of the operating system — and restore from a backup made before the infection. External hard drives or cloud backups that were not connected to the device during the attack are likely unaffected.

If you have no backups

This is the difficult scenario. Three realistic paths exist:

• Check for free decryption tools: The No More Ransom project (nomoreransom.org), a collaboration between law enforcement agencies and security firms, maintains a library of free decryptors for known ransomware strains. It won't help with every variant, but it's worth checking before anything else.
• Wait: Decryption keys for some strains are eventually released when operations are disrupted by law enforcement. This offers no certainty and no timeline.
• Accept the loss: For files that don't have significant personal or financial value, rebuilding may be more practical than any recovery attempt.

On paying the ransom

Law enforcement agencies including the FBI generally advise against paying. There is no contractual obligation for attackers to provide a working key, and many victims who pay receive nothing functional. Payment also sustains the criminal ecosystem.

If a device is lost rather than encrypted, the data risks are different but equally serious — our article on what happens to your data when a phone is stolen explains how that scenario differs. For built-in tools that can help in loss scenarios, see our guide on remote wipe and device lock.

Reducing Your Risk Going Forward

No single measure eliminates ransomware risk entirely, but a layered approach substantially reduces your exposure.

• Maintain offline or isolated backups: An external drive disconnected after each backup, or a cloud service with version history, means encryption of your live files doesn't mean permanent loss. This is the single most important mitigation.
• Keep software updated: Ransomware frequently exploits known vulnerabilities in operating systems and browsers that patches have already fixed. Delayed updates leave that window open.
• Be skeptical of attachments and links: If an email prompts urgency around opening a file or clicking a link — especially from an unexpected sender — verify through a separate channel before acting.
• Avoid unofficial software sources: Download applications only from official developer sites or platform-specific app stores.
• Use standard (non-administrator) accounts for daily use: Ransomware running under a limited account has reduced ability to modify system files or spread.

For a comprehensive view of how these principles apply across all your personal devices, our guide to device security across phones, laptops, and tablets brings these threads together.

“Backups are the single most effective defense against ransomware. If you have a clean, tested backup stored offline, a ransomware attack becomes a serious inconvenience rather than a catastrophe.”

— Cisa.gov Ransomware Guide, U.S. Cybersecurity and Infrastructure Security Agency (CISA) official guidance