Essential terms and concepts for understanding ransomware threats, defense strategies, and incident response. Plain-language definitions for security professionals and business leaders.
A structured plan for creating, storing, and testing data backups to ensure recovery from ransomware attacks.
Cryptocurrency commonly demanded by ransomware operators for ransom payments due to its pseudonymous nature.
Planning and processes that ensure critical business functions continue during and after a ransomware incident.
Encrypted portion of the internet where ransomware groups operate leak sites, sell stolen data, and coordinate attacks.
Unauthorized transfer of data from an organization, often performed before ransomware encryption for double extortion.
A cryptographic key provided by ransomware operators (sometimes after payment) to unlock encrypted files.
Plans and procedures for restoring IT infrastructure and operations after a catastrophic event like a ransomware attack.
Ransomware tactic combining data encryption with data theft, threatening to publish stolen data if the ransom is not paid.