Ransomware
Ransomware is malware that denies access to data or systems, commonly by encrypting files, as part of an attempt to demand payment for restoring access.
Encryption and theft are different harms
Ransomware can make business systems unusable even if the organization still owns the hardware. MITRE describes encryption used to disrupt access to files and other resources. NCSC also notes that attackers may steal data and threaten to publish it.
Keep those events separate. Encrypted files establish an availability problem; they do not, on their own, establish exfiltration. A theft claim without encryption can still be a serious extortion incident, but the claim is not evidence that ransomware ran.
The extortion-claim article explains what a demand proves and what investigators still need to establish. A sender’s claimed group name is not enough to attribute the incident.
The intrusion may start well before the ransom note
The fake IT support article covers Microsoft’s reporting on support impersonation and remote-access misuse in attacks that sometimes led to ransomware. That is one documented route, not a claim that every ransomware incident begins with a phone call.
Recovery involves more than making files readable again. The incident team needs to understand affected systems, remaining access, and whether data was taken. Backups can help restore availability; they do not undo disclosure of stolen information.
Alongside endpoint recovery, check whether compromised accounts or permissions still give the intruder access. The identity containment review covers that part of the response.