Ransomware
Malware that encrypts an organisation's data and demands payment for the decryption key, often paired with data exfiltration and extortion.
Full Definition
Ransomware has evolved from single-extortion (encrypt and demand payment to unlock) to double-extortion (exfiltrate first, then encrypt, demand payment to both unlock and avoid publication) and triple-extortion (adding direct pressure on affected individuals or regulators). The initial access vector is typically a phished credential, an unpatched external service, or a compromised third-party supplier.
Under GDPR Articles 33 and 34, a ransomware incident involving personal data is a notifiable breach — both the integrity (encryption) and the confidentiality (exfiltration) axes of the breach definition are triggered. DPDP Rule 7 applies the same test with no risk threshold. CERT-In's six-hour cyber-incident reporting applies regardless of data content. A mature ransomware response has four non-negotiables: tested offline backups with documented RTOs, pre-prepared regulator and customer communications, legal counsel engaged on paying-vs-not-paying decisions, and a rehearsed incident command structure.
Related terms
Data Breach
A security incident in which personal data is accessed, disclosed, altered, destroyed or lost without authorisation.
Incident Response
The structured process by which an organisation detects, triages, contains, remediates and learns from a security or privacy incident.
Data Exfiltration
The unauthorised movement of personal or sensitive data out of a controlled environment to an attacker-controlled destination.
Relevant regulations
Automate your privacy program
TruePrivacy handles DSRs, consent management, data mapping, and breach response — all in one platform.
Free 14-day trial · No credit card required · Setup in minutes