You sit down at the family computer and every file has a strange new extension. The photos won’t open. A text file on the desktop explains that your data has been encrypted and gives instructions for paying to get it back. If you work from home, the client folders on that machine are locked too.
Ransomware is not only a problem for hospitals and city governments. We investigate and clean up ransomware and financial-theft attacks for individuals and small offices, and the household cases follow a few predictable patterns. Those same patterns tell you where to put your defenses, and a household with the right backups can usually recover without ever considering a payment.
How It Gets In
Home ransomware rarely involves a sophisticated, targeted attack. It usually comes through one of a few doors.
Phishing attachments and links. An invoice, a shipping notice, a “document shared with you.” Opening the attachment or entering a password on a fake login page gives the attacker a foothold. Home-office workers are frequent targets because their inboxes are full of legitimate invoices and shared files, so one more doesn’t stand out.
Cracked and pirated software. Free copies of paid software, game cheats, and “activators” are a common delivery vehicle. The person installing them often disables antivirus because the installer tells them to. That is the attacker asking for permission, and getting it.
Exposed remote access. Remote Desktop (RDP) or another remote-access tool left reachable from the internet, often set up years ago so someone could help with the computer, then forgotten. Attackers scan the internet continuously for these and try common or leaked passwords.
Unpatched NAS devices and routers. A NAS (a small always-on file server on your home network) is a high-value target because it holds everything. Several consumer NAS brands have been hit by ransomware campaigns that exploited firmware vulnerabilities and weak passwords on devices exposed to the internet. Routers with old firmware or remote management turned on are a similar risk.
Reused passwords. A password leaked from one breached site gets tried against your email, your remote-access tools, and your NAS login. If it works anywhere important, the attacker is in without needing any malware at all.
Cloud sync that spreads the damage. This isn’t a way in, but it’s how one infected laptop becomes a household problem. Once malware encrypts files on that laptop, the sync client dutifully uploads the encrypted versions to Dropbox, OneDrive, iCloud Drive, or Google Drive. Every other device signed into that account then pulls down the damaged copies.
Cloud Sync Is Not Backup
That last point surprises people most. Sync keeps folders identical across devices. That is exactly what you don’t want when one device has been compromised: the damage spreads to every copy at the speed of your internet connection.
Some sync services keep version history or a recycle bin, and those features have rescued real people. But retention windows vary by plan, restoring thousands of files one at a time is painful, and an attacker who controls your account can sometimes delete the history too. Treat version history as a possible bonus, not your recovery plan.
A backup is different in three ways. It is a separate copy, it keeps older versions, and at least one copy is out of reach of the device being attacked.
Prevention That Matters
We see a lot of security advice that sounds good and changes little. These are the measures that make the difference in actual recoveries.
Follow 3-2-1 backups, with one copy the attacker can’t touch. Keep three copies of important data, on two different kinds of storage, with one off-site. The part people skip is the most important: at least one copy must be offline (a drive you unplug after each backup) or versioned and immutable, meaning old versions can’t be modified or deleted from the computer being backed up. A practical household setup is a Synology NAS with snapshots enabled, plus an off-site copy with a service such as Backblaze. Note that Backblaze’s personal plan backs up a computer, not a NAS; sending the NAS itself off-site uses their separate B2 cloud storage. The trade-offs are real: a NAS costs money up front and needs maintenance, and an off-site restore of a large photo library can take days. A NAS mapped as an ordinary network drive on every computer can also be encrypted along with everything else, which is why snapshots and restricted access matter. Our article on why every home needs a local server covers the hybrid setup in more detail.
Patch routers and NAS devices, and close what’s exposed. Turn on automatic updates where available. Turn off remote management on the router, and don’t forward ports to your NAS or desktop. If you need remote access, use a VPN or a relay service instead of opening a port to the whole internet.
Turn on MFA everywhere it counts. Email first, since it resets every other password. Then cloud storage, your NAS admin account, banking, and any remote-access tool. Pair it with unique passwords stored in a password manager so one breach doesn’t open everything.
Separate work and family devices. The child downloading a game mod and the parent storing client tax files should not share a computer. If separate hardware isn’t possible, use separate user accounts at minimum. For remote workers and sole proprietors, this is also a client-trust issue: a family member’s mistake shouldn’t become a breach notification you have to send.
Use least-privilege accounts. Day-to-day use should happen in a standard (non-administrator) account. Ransomware running as a standard user can still encrypt that user’s files, but it usually needs admin rights to disable protections, delete local restore points, or reach the whole machine. A standard account also forces a prompt before installs, which gives you a chance to stop and think.
Reputable security software is a useful layer on top of these, but it won’t save you from a missing backup or an exposed remote-access port.
If It Happens: A Step-by-Step Plan
Speed matters, but so does order. Panicked steps in the first hour can destroy the evidence and the recovery options you need later.
- Disconnect. Unplug the network cable or turn off Wi-Fi on the affected machine. Disconnect any external backup drives immediately. If you have a NAS, consider disconnecting it from the network until you know whether it was reached. Leave the machine powered on unless a professional tells you otherwise; some evidence lives only in memory.
- Don’t wipe anything yet. Reinstalling the operating system feels like progress, but it destroys the information needed to identify the strain, find out how the attacker got in, and determine whether any data was stolen as well as encrypted.
- Photograph the ransom note. Use your phone. Capture the note, the new file extensions, any wallet address or contact details, and any countdown timer. Note the date and time you first noticed the problem.
- Identify the strain. The note’s wording, the file extension, and sample encrypted files help identify which ransomware family you’re dealing with. Use reputable identification tools from security vendors and law enforcement partnerships (see the next step), not forums offering paid “decryption services,” which are sometimes scams or middlemen who quietly pay the attacker and mark up the fee.
- Check for a free decryptor. The No More Ransom project, a partnership between law enforcement and security companies, collects free decryption tools for strains whose encryption has been broken. Many current strains have no free decryptor, but checking costs nothing.
- Restore from clean backups. Wipe and reinstall affected machines, then restore data from a backup made before the infection. Check the restored files before reconnecting anything else, and make sure you aren’t restoring the original malicious installer or attachment along with the data.
- Change credentials from a clean device. Assume any password typed or saved on the infected machine is compromised. Change them from a different, known-clean device, starting with your password manager’s master password and your email, then financial accounts and cloud storage. Sign out all other sessions where services allow it, and check your email for forwarding rules or recovery addresses you didn’t set up.
- Report it. File a report with the FBI’s Internet Crime Complaint Center at ic3.gov. Reports help investigators connect cases, and having one on file can help with banks and insurers. If client data was involved, you may have notification obligations; get advice on that specifically.
When we handle these cases, documentation is a large part of the work: a clear timeline, the note, the indicators, and what was touched. Those records are what let us escalate to the FBI, to banks when money moved, and to infrastructure providers such as Cloudflare when the attacker’s sites sit behind their services.
The Question of Paying
People ask us whether they should just pay. Here is our honest answer.
Payment does not guarantee decryption. Attackers sometimes provide a decryptor that is slow, buggy, or fails on some files. Some never respond after receiving money. Paying also marks you as someone who pays, and in many cases attackers have already copied data and may threaten to publish it regardless.
There are legal considerations as well. Payments to certain groups or jurisdictions can raise sanctions issues, and the rules are not something to work out under a countdown timer. If payment is on the table at all, talk to a lawyer first.
We don’t tell anyone what they must do in a situation like this. Our work focuses on making the question irrelevant: when a clean, offline or immutable backup exists, the ransom note becomes an inconvenience and a reporting task rather than a negotiation. We can’t promise every recovery will be complete, especially if backups were never set up or were reached by the attacker. What we can say is that households with tested, isolated backups are in a very different position from those without them.
Getting Help
Most of this is set-up work that’s far easier to do before anything goes wrong: a NAS with snapshots, an off-site copy, patched equipment, and nothing exposed to the internet that doesn’t need to be. We design and install these systems for homes and home offices, and test that the restore actually works. If you want a backup setup that would hold up against ransomware, see our local server and backup services. If you’re dealing with an active incident, contact us and we’ll help you work through the next steps.