Larry Magid: How to avoid or recover from a ransomware attack

One of your most effective weapons is taking the proactive step of backing up your data

Ransomware is one of numerous online crimes designed to separate people, businesses and government agencies from their money.

The crime typically involves a person or an organized crime group encrypting your data and demanding a ransom payment to unlock it. It’s like kidnapping for your data.

We typically hear about big attacks against agencies or businesses like the May 2021 attack against Colonial Pipeline, which had to shut down fuel delivery for several days, affecting millions of people, mostly on the East Coast. In 2023, Oakland was attacked, causing massive disruptions in city services. The smaller city of Oakley was struck in February of this year, prompting the city manager to declare a state of emergency.

I’ll leave it up to IT professionals to advise government agencies and big companies, but ransomware attacks can also be aimed at individuals who might wind up accidentally installing malicious software on their computers. And, even though individuals are not likely to pay the multimillion-dollar ransoms often demanded from big institutions, individuals could be asked to pay hundreds or even thousands of dollars to get their data back. Even if they pay, there is no guarantee that their systems will be restored, which is one of the reasons authorities advise people not to pay ransomware demands.

Backups are essential

Before I get to how to prevent a ransomware attack, my first piece of advice is to always have at least one backup of all your important data so that you can recover from an attack or any other loss of data. I have all my data on a cloud service and another backup on an external drive. Although there is a very small risk of the cloud data being impacted by a ransomware attack, it is much less vulnerable than the data on your PC. In addition to protecting your data from a ransomware attack, cloud storage also protects you if your device or backup device is destroyed, lost or stolen. Some of the popular cloud services include Dropbox, Microsoft OneDrive, Apple iCloud and Google One. Microsoft Office subscriptions come with up to one terabyte of data storage, depending on what type of subscription you have.

Make sure you have your cloud storage configured to automatically backup data as it’s created so you’re always up-to-date. Most cloud services also keep older versions of files, which enables you to recover unencrypted copies of your data even if an encrypted file is backed up to their servers. If you ever are attacked, it’s important to restore the unaffected files as soon as possible once you’re sure your machine no longer has malware, because these companies have limits on how long they store older versions. The cost of these services depends on how much storage you use, but you only have to back up your data, not your entire computer. In the event of a disaster, there are other ways to recover your operating system and software.

Human behavior

Although there are technical things you can do to help prevent ransomware and other malware attacks, the likely risks involve human behavior such as falling for phishing attacks. Scammers will send emails, texts or messages that look as if they’re coming from a legitimate company or organization, such as a bank or Social Security Administration. They may ask you to click on a link that will take you to a rogue website that might automatically download malware to your device or ask you to log into what you think might be an account, only to steal your username and password. When I get an email with a link, I first make sure it’s really from the company. If it claims to be from Wells Fargo, for example, I’d make sure it’s from wellsfargo.com, not something like wellsfargo.xyz.com.  When in doubt, I go directly to the site by typing in its web address rather than clicking on a link. Once when I got a very legitimate looking email from what appeared to be my bank, I called the bank to verify if it was from them.

If you get a call or see a popup message telling you about a virus attack or other security vulnerability, it’s almost certainly a scam, especially if they ask you to click on something that gives them permission to access your device to “fix” the problem.  Remote access is sometimes used by legitimate companies, but only allow it if you contact them – not if they call or email you – and are certain you’re dealing with the real company.

Update your software

It’s also important to keep your software up to date. This is especially important with operating systems like Windows and MacOS but also with browsers that are often vectors for attacks. But any software program can be compromised, so make sure you keep up with updates on all of your programs, ensuring that you’re only getting updates from the company itself or a legitimate app store. Beware of any offers you get to update or install software unless you’re sure they are from a legitimate source.

Anti-virus programs can help you avoid malware and other malicious attacks and automatically update your software. They’re not a substitute for being cautious, but they do help. There are numerous programs on the market, but Microsoft Defender, which comes with Windows, is quite good.  The Mac doesn’t have an antivirus program, but it does have a lot of built-in security features, although Macs and Mac users can be vulnerable. There are some good antivirus programs for Macs that add additional security. You can find links to reviews of Mac and Windows anti-malware software at connectsafely.org/securitysoftware.

Finally, as with all security risks, it’s essential to use strong, long and unique passwords and additional precautions such as two-factor authentication for websites and apps, especially financial, health, social media and email. You can learn about how to create strong yet easy-to-remember passwords as well as other security advice at ConnectSafely.org/passwords.

Larry Magid is a tech journalist and internet safety activist. Contact him at larry@larrymagid.com.