What is ransomware?
Ransomware is malicious software that encrypts or locks files or entire systems and then demands a ransom, usually in cryptocurrency, in exchange for a key to restore access. Modern attackers also steal sensitive data first and threaten to publish it, so a good backup on its own is no longer enough. For companies, governments, healthcare institutions and industrial organisations, ransomware is one of the most disruptive forms of cybercrime. In industrial environments, an attack that starts on the office network can halt entire production lines within days.
🧠 How does a ransomware attack unfold?
A modern attack is not a virus that slips in by chance, but an operation that takes days to weeks. The stages map onto the Cyber Kill Chain and MITRE ATT&CK for ICS:
- Initial access - through phishing, stolen passwords, a VPN or RDP without MFA, a vulnerability in an internet-facing application, or a compromised supplier with remote access.
- Persistence and reconnaissance - the attacker installs administration tools, maps the network and hunts for privileged accounts.
- Lateral movement - via Active Directory and the domain controller the attacker gains domain admin rights and spreads to servers, backup systems and sometimes the OT environment.
- Data exfiltration - sensitive files are copied out as leverage.
- Disabling backups - shadow copies are deleted and online backups are encrypted or wiped.
- Encryption - fast symmetric encryption of files, with each file key in turn encrypted using the attacker’s public key; without the attacker’s private key, recovery is practically impossible.
- Extortion - a ransom note with a payment deadline and a pointer to a leak site.
📦 What types of ransomware and extortion exist?
| Type | How it works | Consequence for you |
|---|---|---|
| Crypto-ransomware | Encrypts files and folders | Data unusable until restored or decrypted |
| Locker ransomware | Blocks access to the whole device or operating system without encrypting files | System unusable, data often still intact |
| Double extortion | Steals data, then encrypts; threatens publication (without encryption also called doxware or leakware) | A backup does not help against the data leak |
| Triple extortion | Adds a DDoS attack or contacting customers and patients | Extra pressure via reputation and third parties |
| Wiper disguised as ransomware | Destroys data; the “ransom” is a cover | Recovery only possible from backup |
Double extortion became mainstream in late 2019, when the Maze group published stolen data from a victim that refused to pay. Since then, virtually every major group has adopted it.
💼 What is Ransomware-as-a-Service (RaaS)?
With Ransomware-as-a-Service, a core group develops the ransomware, the payment infrastructure and the leak site, and rents them out to affiliates who carry out the intrusions. Proceeds are shared, with the affiliate usually taking the larger part, often 70 to 80 per cent. On top of that, initial access brokers sell ready-made access to corporate networks. This business model explains the scale: between late 2019 and early 2024, LockBit claimed more than 2,500 victims worldwide, until an international law-enforcement operation (Operation Cronos) seized its infrastructure in February 2024. After such takedowns, affiliates regroup and new brands appear quickly.
🏭 What does ransomware do in OT and ICS environments?
Ransomware rarely encrypts the logic inside a PLC itself. The damage lies in the Windows layers above it: HMI stations, SCADA servers, the historian, the engineering station and the links to planning and logistics. Without visibility and control, an operator often has to shut the process down, even when the control system is still running. Some strains, such as EKANS (2019), carry a list of dozens of processes they kill first, including historian and HMI software from major ICS vendors.
| Incident | Year | What happened? | Lesson |
|---|---|---|---|
| NotPetya | 2017 | Wiper spread via a tampered update of Ukrainian accounting software; over 10 billion dollars of damage worldwide, around 300 million at Maersk | ”Ransomware” can make recovery impossible; the supply chain as entry point |
| Norsk Hydro | 2019 | LockerGoga hit some 22,000 computers at 170 sites in 40 countries; plants switched to manual operation; no ransom paid, costs over 70 million dollars | Manual fallback procedures and open communication keep the business running |
| Maastricht University | 2019 | Clop on 267 servers after phishing; 30 bitcoin (about €200,000) paid | Weeks of undetected lateral movement |
| Hof van Twente (NL municipality) | 2020 | Admin account with the password “Welkom2020” and no two-factor; backups destroyed; no ransom paid, damage over €4 million | Basic hygiene and disconnected backups |
| Colonial Pipeline | 2021 | Access via an unused VPN account without MFA; only IT (including billing) encrypted, yet the 5,500-mile pipeline was shut down as a precaution for six days | An IT incident becomes OT downtime through dependencies |
According to the Dragos OT year in review, 119 ransomware groups affected some 3,300 industrial organisations in 2025, more than two thirds of them in manufacturing. Average dwell time in OT environments was 42 days, against roughly 5 days for organisations with good OT monitoring.
🔐 How do you protect against ransomware?
| Measure | What it stops | OT consideration |
|---|---|---|
| MFA on all external access | Intrusion with stolen passwords | Include suppliers and remote maintenance |
| Patch management | Exploitation of known vulnerabilities | Internet-facing systems within days; OT in maintenance windows |
| Network segmentation | Lateral movement from IT to OT | Segmentation following the zones and conduits model of IEC 62443, with a DMZ and firewall |
| Offline and immutable backups | Extortion through encryption | Also back up PLC programs, HMI projects and configurations |
| EDR and antivirus | Execution and spread of malware | On OT hosts only with vendor approval; otherwise application whitelisting |
| Least privilege and tiering | Takeover of domain administration | Separate domains and accounts for OT; access through a jump server |
| Awareness | Phishing and social engineering | Train operators and technicians too |
For backups, apply the 3-2-1-1-0 rule: three copies, on two types of media, one off-site, one offline or immutable, and zero errors in restore tests. Combine prevention with detection, for example through an OT SOC, and strong authentication.
🧭 How do you handle a ransomware incident step by step?
- Isolate affected systems and the link between IT and OT, but do not simply power machines off: memory holds traces for forensic investigation.
- Activate the incident response plan and the crisis team, with pre-agreed roles and a printed contact list.
- Bring the process to a safe state: run manually or stop in a controlled way; safety comes before production.
- Report and file a complaint with the police, involve the NCSC or your sector CSIRT, and report a personal-data breach within 72 hours to the Dutch Data Protection Authority under the GDPR.
- Look for a decryptor on No More Ransom, the platform launched in July 2016 by the Dutch police, Europol, Kaspersky and McAfee.
- Restore from clean backups only after the entry point is closed and all passwords have been replaced; follow the recovery order in your disaster recovery plan.
Should you pay the ransom?
The NCSC and the police advise against paying: there is no guarantee of working keys, you fund crime and you may be extorted again. Even after payment, stolen data stays in the attacker’s hands. Cyber insurance does not always cover ransom, and paying parties on a sanctions list is prohibited.
What reporting obligation applies in the Netherlands?
The Dutch Cybersecurity Act (Cyberbeveiligingswet), the national implementation of NIS2, has applied since 15 August 2026. Essential and important entities report a significant incident with an early warning within 24 hours, an incident notification within 72 hours and a final report within one month. A ransomware attack that affects service delivery almost always qualifies.
❓ Frequently asked questions
What is the difference between ransomware and a wiper?
Ransomware encrypts data with the intention of releasing it in return for payment, whereas a wiper destroys data beyond recovery. NotPetya looked like ransomware in 2017, but could not decrypt anything even after payment. With a wiper, restoring from backup is the only way back.
Can ransomware encrypt a PLC?
Common ransomware targets Windows systems and does not encrypt the logic inside a PLC. Ransomware can still halt a production process, because HMI stations, SCADA servers and engineering stations are affected. Without control and visibility, operators often decide to stop the process. The 2025 cyberattack on Jaguar Land Rover showed that a compromised IT environment alone can halt car production for weeks.
Why is MFA so important against ransomware?
Many ransomware attacks start with a stolen or guessed password on a VPN, an RDP connection or an admin account. MFA ensures that such a password alone is not enough to get in. At Colonial Pipeline and Hof van Twente, MFA was missing on exactly the account that was abused.
Do backups still help against modern ransomware?
Backups remain the most important defence against encryption, provided they are offline or immutable and tested regularly. Attackers actively look for online backups to wipe them first. Backups offer no protection, however, against the publication of stolen data in double extortion.
How long does recovery from a ransomware attack take?
Recovery from ransomware usually takes days to weeks, and full normalisation sometimes months. Colonial Pipeline was down for six days, while Norsk Hydro ran partly on manual processes for weeks. A rehearsed recovery plan with a fixed order of systems shortens downtime considerably.
What is No More Ransom?
No More Ransom is a free platform run by partners including the Dutch police and Europol that offers decryption tools for more than 150 ransomware families. Victims can upload an encrypted file and the ransom note to identify the strain. For new strains, a decryptor is often not available.
📌 In summary
Ransomware is extortion software that encrypts systems and steals data, and in industrial environments it can halt entire production processes through affected HMIs, servers and dependencies. MFA, patching, segmentation between IT and OT, offline or immutable backups and a rehearsed response plan determine whether an attack remains an incident or becomes a crisis.