{"id":248464,"date":"2026-11-03T00:30:23","date_gmt":"2026-11-03T00:30:23","guid":{"rendered":"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/"},"modified":"2026-11-03T00:30:24","modified_gmt":"2026-11-03T00:30:24","slug":"phishing-and-ransomware","status":"publish","type":"post","link":"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/","title":{"rendered":"Phishing and Ransomware: How One Leads to the Other"},"content":{"rendered":"<div class=\"336cb5b64765e27a1a6c1bb71b941f1a\" data-index=\"1\" style=\"float: none; margin:10px 0 10px 0; text-align:center;\">\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-4830628043307652\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- above content -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-4830628043307652\"\r\n     data-ad-slot=\"5864845439\"\r\n     data-ad-format=\"auto\"\r\n     data-full-width-responsive=\"true\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<\/div>\n<\/p>\n<p>Phishing and ransomware are two stages of the same problem. Phishing is the lure: a message that tricks you into clicking, opening a file or handing over a password. Ransomware is one of the things that lure can deliver: malware that locks your files or systems and demands payment. Break the chain at the phishing stage and most ransomware never gets a foothold. This guide explains how the two connect, what the warning signs look like, and what to do before and after an attack.<\/p>\n<div data-blg-cta=\"after_tldr\" data-blg-cta-layout=\"banner\" style=\"margin:28px 0;font-family:-apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, Helvetica, Arial, sans-serif\">\n<div style=\"border-radius:26px;padding:min(22px,3.2vw)\">\n<div style=\"background:#ffffff;border-radius:18px;overflow:hidden\">\n<div style=\"padding:34px 30px;text-align:center\">\n<div style=\"margin:0 0 18px\"><span style=\"max-width:100%;border-radius:999px;padding:6px 13px;font-size:12px;font-weight:800;letter-spacing:0.1em;text-transform:uppercase;line-height:1.3;background:#F47F24;color:#ffffff\">Logmeonce<\/span><\/div>\n<div style=\"font-size:26px;font-weight:800;line-height:1.2;letter-spacing:-0.01em;color:#1f2937;margin:0\">Strengthen Your Digital Defenses<\/div>\n<div style=\"width:56px;height:6px;border-radius:3px;background:#F47F24;margin:12px 0 14px;margin-left:auto;margin-right:auto\"><\/div>\n<div style=\"font-size:15px;line-height:1.55;color:#64748b;margin:0 0 24px;max-width:44em;margin-left:auto;margin-right:auto\">Explore LogMeOnce resources on password management, multi-factor authentication, and identity security to learn more about protecting accounts and data.<\/div>\n<p><a href=\"https:\/\/logmeonce.com\/resources\" style=\"align-items:center;gap:9px;border-radius:10px;font-weight:700;font-size:15px;text-decoration:none;padding:13px 22px 13px 26px;background:#F47F24;color:#ffffff\">Explore security resources<\/a><\/div>\n<\/div>\n<\/div>\n<\/div>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><a href=\"#\" class=\"ez-toc-pull-right ez-toc-btn ez-toc-btn-xs ez-toc-btn-default ez-toc-toggle\" aria-label=\"Toggle Table of Content\"><span class=\"ez-toc-js-icon-con\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/span><\/a><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#TLDR\" >TL;DR<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Phishing_and_ransomware_in_plain_terms\" >Phishing and ransomware in plain terms<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#How_phishing_works\" >How phishing works<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#How_ransomware_works\" >How ransomware works<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#How_phishing_leads_to_ransomware\" >How phishing leads to ransomware<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Warning_signs_worth_stopping_for\" >Warning signs worth stopping for<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Prevention_for_individuals\" >Prevention for individuals<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Prevention_for_organizations\" >Prevention for organizations<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Backups_the_part_that_decides_your_recovery\" >Backups: the part that decides your recovery<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Is_ransomware_a_data_breach\" >Is ransomware a data breach?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#What_to_do_if_you_think_you_were_hit\" >What to do if you think you were hit<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Our_perspective\" >Our perspective<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Put_these_protections_in_place\" >Put these protections in place<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#What_is_the_difference_between_phishing_and_ransomware\" >What is the difference between phishing and ransomware?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#What_is_the_difference_between_phishing_and_malware\" >What is the difference between phishing and malware?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Can_ransomware_infect_me_without_phishing\" >Can ransomware infect me without phishing?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Is_ransomware_considered_a_data_breach\" >Is ransomware considered a data breach?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Should_I_pay_the_ransom\" >Should I pay the ransom?<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/logmeonce.com\/resources\/phishing-and-ransomware\/#Sources\" >Sources<\/a><\/li><\/ul><\/nav><\/div>\n<h2 id=\"tldr\"><span class=\"ez-toc-section\" id=\"TLDR\"><\/span>TL;DR<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li>Phishing is a common way in. A bad link, attachment or stolen password gives an attacker the first foothold, and ransomware can follow.<\/li>\n<li>Ransomware today often steals data before it encrypts anything, so a restored backup does not always end the problem.<\/li>\n<li>Pause on urgent requests, verify through a contact method you already trust, and report suspicious messages instead of just deleting them.<\/li>\n<li>Training alone is not enough. Combine strong, unique passwords, multi-factor authentication, filtering, patching and tested backups.<\/li>\n<li>If you suspect an attack, stop clicking, disconnect the affected device, change passwords from a clean device, and report it.<\/li>\n<\/ul>\n<h2 id=\"phishing-and-ransomware-in-plain-terms\"><span class=\"ez-toc-section\" id=\"Phishing_and_ransomware_in_plain_terms\"><\/span>Phishing and ransomware in plain terms<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The U.S. Cybersecurity and Infrastructure Security Agency (CISA) draws a clean line between the threats. <a href=\"https:\/\/www.cisa.gov\/topics\/cyber-threats-and-response\/malware-phishing-and-ransomware\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Malware is software used to gain unauthorized access to systems, steal data or disrupt services; ransomware is malware that holds data or systems captive until a ransom is paid; phishing is an online scam that entices people to share private information<\/a>.<\/p>\n<p>That gives you a simple way to remember them:<\/p>\n<table>\n<thead>\n<tr>\n<th>Threat<\/th>\n<th>What it is<\/th>\n<th>What it needs from you<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Phishing<\/td>\n<td>A deceptive message (email, text, call, chat) pretending to be someone you trust<\/td>\n<td>A click, a reply, a password or an opened file<\/td>\n<\/tr>\n<tr>\n<td>Malware<\/td>\n<td>Software that does harm once it runs<\/td>\n<td>To be installed or executed, often after a phishing click<\/td>\n<\/tr>\n<tr>\n<td>Ransomware<\/td>\n<td>A type of malware that blocks access to files or systems and demands payment<\/td>\n<td>Nothing more, once it is running on a device or network<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>Phishing is a delivery method and a social-engineering technique. Ransomware is a payload. They are not rivals; one frequently carries the other.<\/p>\n<h2 id=\"how-phishing-works\"><span class=\"ez-toc-section\" id=\"How_phishing_works\"><\/span>How phishing works<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>CISA\u2019s joint guidance describes phishing as <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2023-10\/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">social engineering in which an attacker impersonates a trusted source and lures a victim, usually by email but also through messages, calls or collaboration tools<\/a>. The victim is pushed to visit a malicious site, disclose credentials or open a malicious attachment.<\/p>\n<p>The same guidance names two main goals. The first is stolen credentials, which give an attacker a way into a network. The second is deploying malware that causes later disruption, damage, privilege escalation or persistence. Ransomware belongs in that second group.<\/p>\n<p>Phishing comes in several shapes:<\/p>\n<ul>\n<li><strong>Mass phishing.<\/strong> The same lure goes to thousands of people: a fake delivery notice, a bogus password-expiry warning, a counterfeit invoice.<\/li>\n<li><strong>Spear phishing.<\/strong> The UK\u2019s National Cyber Security Centre (NCSC) notes that phishing can be indiscriminate or targeted, and that in <a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">spear phishing attackers use information about an employee or company to make the lure more convincing<\/a>.<\/li>\n<li><strong>Text, chat and mobile lures.<\/strong> The U.S. guidance points out that attackers also use SMS, collaboration platforms and mobile apps, where small screens and <a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2023-10\/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">constrained interfaces can make a malicious URL harder to spot<\/a>.<\/li>\n<\/ul>\n<h2 id=\"how-ransomware-works\"><span class=\"ez-toc-section\" id=\"How_ransomware_works\"><\/span>How ransomware works<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>CISA defines ransomware as <a href=\"https:\/\/www.cisa.gov\/stopransomware\/ransomware-faqs\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">malware that encrypts files or otherwise blocks access to systems or data and demands payment, commonly for decryption<\/a>. The same page says current attacks may also steal data, move laterally through networks, delete backups, and threaten to leak or sell what was taken.<\/p>\n<p>The U.S. Secret Service describes the variety: ransomware can <a href=\"https:\/\/www.secretservice.gov\/investigations\/ransomware\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">deny access to systems or data, exfiltrate data, lock screens or encrypt valuable files, and some versions operate purely as extortion by threatening leaks<\/a>.<\/p>\n<p>Nobody is exempt by size or sector. CISA notes that ransomware increasingly affects <a href=\"https:\/\/www.cisa.gov\/stopransomware\/ransomware-faqs\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">state, local, tribal and territorial governments, critical infrastructure and service providers<\/a>, so the risk is not limited to a company\u2019s own on-premises servers. If you rely on a vendor or a cloud service, their exposure becomes part of yours.<\/p>\n<h2 id=\"how-phishing-leads-to-ransomware\"><span class=\"ez-toc-section\" id=\"How_phishing_leads_to_ransomware\"><\/span>How phishing leads to ransomware<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The U.S. National Institute of Standards and Technology (NIST) lays out the path for small businesses. A victim clicks a malicious link or attachment and executes the downloaded file, which gives the attacker an initial foothold. <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/ransomware\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">The ransomware can then exploit vulnerabilities, spread to other computers, encrypt files and display a ransom demand<\/a>.<\/p>\n<p>NIST also gives a very ordinary example: a phishing email that carries an attachment dressed up as an urgent invoice. Nothing about it needs to look technical. It only needs to look like work.<\/p>\n<p>Here is the chain in practice:<\/p>\n<ol>\n<li><strong>The lure.<\/strong> An employee gets a message that appears to come from a supplier, a boss or an IT team.<\/li>\n<li><strong>The foothold.<\/strong> They open the attachment, click the link or type their password into a fake login page.<\/li>\n<li><strong>The quiet phase.<\/strong> The attacker explores, collects more credentials and looks for backups and valuable data. NIST notes that vulnerabilities can let criminals plant malware that <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/ransomware\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">stays hidden before data theft and ransomware deployment<\/a>.<\/li>\n<li><strong>The strike.<\/strong> Files are encrypted, data may be copied, and a ransom note appears.<\/li>\n<\/ol>\n<p>The NCSC puts it briefly: phishing messages may contain <a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">links to malicious websites carrying malware such as ransomware, or may steal passwords or induce money transfers<\/a>. So a single phishing campaign can end in three different losses: malware, stolen accounts, or a fraudulent payment.<\/p>\n<p>One caution about the numbers. Older articles quote that phishing accounted for between 25% and 30% of ransomware cases in 2020, and other sources describe it as the usual starting point. Phishing is a leading entry route, but not the only one: unpatched software and exposed remote-access services also give attackers a way in. That is why defense needs more than one layer.<\/p>\n<h2 id=\"warning-signs-worth-stopping-for\"><span class=\"ez-toc-section\" id=\"Warning_signs_worth_stopping_for\"><\/span>Warning signs worth stopping for<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>NIST\u2019s small-business advice boils down to friction: slow down, then check. It recommends <a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">treating links and attachments cautiously, pausing over urgent requests, verifying through known contact details rather than the message itself, and checking sender addresses<\/a>.<\/p>\n<p>Use this checklist on any unexpected message:<\/p>\n<ul>\n<li><strong>Urgency or fear.<\/strong> \u201cYour account will be closed today.\u201d \u201cPay this invoice now.\u201d Pressure is the main tool.<\/li>\n<li><strong>A sender address that is almost right.<\/strong> Look at the full domain, not just the display name. One swapped letter is enough.<\/li>\n<li><strong>A request for sensitive information.<\/strong> Real providers rarely ask for passwords or codes by email, text or phone.<\/li>\n<li><strong>An attachment you did not expect.<\/strong> Invoices, shipping documents and \u201cvoicemail\u201d files are common disguises.<\/li>\n<li><strong>A link that does not match its label.<\/strong> On a computer, hover to preview the destination. On a phone, open the service by typing its address or using its app.<\/li>\n<li><strong>A change in how a familiar person writes.<\/strong> A colleague who suddenly asks for gift cards or a bank change deserves a phone call.<\/li>\n<\/ul>\n<p>For any of these, contact the supposed sender using a phone number or address you already have. Do not use the details in the message.<\/p>\n<h2 id=\"prevention-for-individuals\"><span class=\"ez-toc-section\" id=\"Prevention_for_individuals\"><\/span>Prevention for individuals<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>You do not need a security team to cut your risk sharply. Start with these habits.<\/p>\n<p><strong>Do not click, report.<\/strong> CISA advises that if you suspect phishing, you <a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">do not click suspicious links or attachments, and instead report the message through the relevant service or the spam-reporting function<\/a>. Reporting helps providers block the same message for other people.<\/p>\n<p><strong>Make stolen passwords useless.<\/strong> Credentials are one of the two main phishing goals, so the damage depends on what a stolen password can open. Give every account a long, unique password, and turn on multi-factor authentication wherever it is offered. A <a href=\"https:\/\/logmeonce.com\/password-manager\" target=\"_blank\" rel=\"noopener\">password manager<\/a> creates and fills those passwords for you, and it will not autofill on a lookalike site, which is itself a useful warning sign.<\/p>\n<p><strong>Consider removing the password altogether.<\/strong> Passwordless sign-in, for example with a biometric or a trusted device, leaves less for a fake login page to capture. See how <a href=\"https:\/\/logmeonce.com\/passwordless-mfa\" target=\"_blank\" rel=\"noopener\">passwordless MFA<\/a> works if you want to go that route.<\/p>\n<p><strong>Watch for your data elsewhere.<\/strong> Phishing kits and breaches feed each other. Credentials taken in one place get tried in others. A <a href=\"https:\/\/logmeonce.com\/dark-web-scan-tool\" target=\"_blank\" rel=\"noopener\">dark web scan<\/a> can show whether your email address or other details have surfaced, so you can change what is exposed before someone uses it.<\/p>\n<p><strong>Keep software updated and back up what matters.<\/strong> Updates close the holes that ransomware exploits after the initial click. Backups are your recovery plan, covered below.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/media.babylovegrowth.ai\/blog-images\/organization-6456\/1793541695780_Prevention-for-individuals.jpeg\" alt=\"Prevention for individuals\" title=\"\"><\/p>\n<h2 id=\"prevention-for-organizations\"><span class=\"ez-toc-section\" id=\"Prevention_for_organizations\"><\/span>Prevention for organizations<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The NCSC says user training alone is not enough, because <a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">some phishing will always get through<\/a>, and recommends combining technology, process and people-based controls and planning for incidents. It describes four layers:<\/p>\n<ol>\n<li>Make it difficult for attackers to reach your users.<\/li>\n<li>Help users identify and report suspected phishing.<\/li>\n<li>Protect your organization from the messages that go undetected.<\/li>\n<li>Respond quickly to incidents.<\/li>\n<\/ol>\n<p>CISA\u2019s #StopRansomware Guide fills in the technical detail. Its recommendations include <a href=\"https:\/\/www.cisa.gov\/stopransomware\/ransomware-guide\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">awareness and reporting training, flagging of external email, gateway and attachment filtering, regular review of blocked file types, and firewall blocking of suspicious IP addresses<\/a>. It also recommends DMARC with SPF and DKIM to reduce spoofing of your own domain, while noting that DMARC does not protect you from incoming mail spoofed from domains whose owners have not set it up.<\/p>\n<p>A practical order of work for a small or mid-sized company:<\/p>\n<table>\n<thead>\n<tr>\n<th>Priority<\/th>\n<th>Action<\/th>\n<th>Why it matters<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>1<\/td>\n<td>Multi-factor authentication on email, remote access and admin accounts<\/td>\n<td>A phished password alone no longer opens the door<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Unique passwords stored in a business password manager<\/td>\n<td>Stops reuse spreading one theft across systems<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Email filtering, external-sender banners, DMARC\/SPF\/DKIM<\/td>\n<td>Fewer lures reach inboxes, and your domain is harder to impersonate<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>Patching and removing unused software<\/td>\n<td>Closes the routes ransomware uses after the first foothold<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Tested, separated backups<\/td>\n<td>Lets you recover without negotiating<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>A written response plan and a one-click reporting route<\/td>\n<td>Cuts the time between click and containment<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>If you manage many users, the <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">Teams, Business and Enterprise plans<\/a> bring password management, single sign-on and multi-factor authentication under one admin console, so the controls above are enforced rather than requested.<\/p>\n<h3 id=\"backups-the-part-that-decides-your-recovery\"><span class=\"ez-toc-section\" id=\"Backups_the_part_that_decides_your_recovery\"><\/span>Backups: the part that decides your recovery<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The NCSC says up-to-date backups are <a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/mitigating-malware-and-ransomware-attacks\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">the most effective recovery measure<\/a>. Its guidance covers:<\/p>\n<ul>\n<li>Restore tests on a regular schedule, so you know the backups work.<\/li>\n<li>Offline or separately located copies, in more than one place.<\/li>\n<li>Protection against deletion of previous cloud versions.<\/li>\n<li>Malware scanning before you restore.<\/li>\n<li>Patching the backup products themselves.<\/li>\n<\/ul>\n<p>Because modern attacks can also steal data, encrypting what you store adds a second safeguard: if a copy is taken, it is unreadable. Our <a href=\"https:\/\/logmeonce.com\/resources\" target=\"_blank\" rel=\"noopener\">Cloud Storage Encrypter<\/a> is built for that purpose.<\/p>\n<h2 id=\"is-ransomware-a-data-breach\"><span class=\"ez-toc-section\" id=\"Is_ransomware_a_data_breach\"><\/span>Is ransomware a data breach?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Often, yes in practice, and you should plan as if it is. Whether it counts legally depends on your jurisdiction, the type of data and the rules that apply to you, so ask your counsel or compliance officer.<\/p>\n<p>Here is the best-documented U.S. example. Under HIPAA, the Department of Health and Human Services has said that <a href=\"https:\/\/www.hlc.com\/en\/publications\/hhs-issues-new-guidance-on-ransomware-and-hipaa\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">a ransomware attack is a security incident and will typically be treated as a breach unless the organization can show a low probability that the data was compromised<\/a>. That is a healthcare rule, not a universal one, but the logic carries over: once an attacker has had control of your data, you cannot assume it was untouched.<\/p>\n<p>Add the data-theft pattern CISA describes, where attackers copy information and threaten to leak it, and the safe approach is to treat any ransomware event as a possible breach until the investigation says otherwise. Our guide on <a href=\"https:\/\/logmeonce.com\/blog\/password-management\/sos-what-to-do-after-a-data-breach\" target=\"_blank\" rel=\"noopener\">what to do after a data breach<\/a> walks through the follow-up steps.<\/p>\n<h2 id=\"what-to-do-if-you-think-you-were-hit\"><span class=\"ez-toc-section\" id=\"What_to_do_if_you_think_you_were_hit\"><\/span>What to do if you think you were hit<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Speed matters, and so does calm. This is a sensible first-hour sequence for most people and small teams.<\/p>\n<ol>\n<li><strong>Stop interacting.<\/strong> Do not click further, do not reply, and do not open the attachment again.<\/li>\n<li><strong>Disconnect the device.<\/strong> Take it off Wi-Fi and unplug network cables so malware cannot spread. Do not wipe it yet; investigators may need it.<\/li>\n<li><strong>Change passwords from a clean device.<\/strong> Start with email, banking and any account that shares the phished password. Turn on multi-factor authentication.<\/li>\n<li><strong>Tell the right people.<\/strong> At work, that means your IT or security contact straight away. At home, contact your bank if money or card details were involved.<\/li>\n<li><strong>Report it.<\/strong> Report phishing messages through your email provider\u2019s reporting function, and report ransomware to the relevant authorities. CISA\u2019s <a href=\"https:\/\/www.cisa.gov\/stopransomware\/ransomware-faqs\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">StopRansomware pages<\/a> are the place to start for U.S. readers.<\/li>\n<li><strong>Watch for follow-on fraud.<\/strong> Stolen details can resurface weeks later in identity theft attempts. Keep an eye on financial statements and credit reports, and consider <a href=\"https:\/\/logmeonce.com\/identity-theft-protection\" target=\"_blank\" rel=\"noopener\">identity theft protection<\/a> that includes dark web monitoring.<\/li>\n<\/ol>\n<p>For guidance on whether to pay a ransom, speak to law enforcement and your incident-response advisers before making any decision. Payment does not guarantee you get your data back, and it can mark you as a willing payer.<\/p>\n<h2 id=\"our-perspective\"><span class=\"ez-toc-section\" id=\"Our_perspective\"><\/span>Our perspective<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<blockquote>\n<p>We see phishing and ransomware as one story, and the most useful place to stop it is the very first page of that story: the login.<\/p>\n<p>Most advice tells people to be more careful. We agree, and humans do catch many lures. But carefulness has a limit, and the NCSC says so itself: some phishing will get through. A good security setup assumes that one day someone will type a password into the wrong box, and makes sure that moment is survivable.<\/p>\n<p>That is why we build around the credential. A password manager that refuses to fill a lookalike site, unique passwords on every account, and passwordless multi-factor authentication all shrink what a single mistake can cost. Our identity theft protection and dark web monitoring then watch for the aftermath, because stolen details rarely stay quiet. Our encrypted cloud storage adds a layer for the files themselves.<\/p>\n<p>None of these replaces backups, patching or training. Together they turn a catastrophic click into an inconvenient one.<\/p>\n<p><em>Mike<\/em><\/p>\n<\/blockquote>\n<h2 id=\"put-these-protections-in-place\"><span class=\"ez-toc-section\" id=\"Put_these_protections_in_place\"><\/span>Put these protections in place<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>If you want one place to cover passwords, sign-in and exposure monitoring, start with the <a href=\"https:\/\/logmeonce.com\/password-manager\" target=\"_blank\" rel=\"noopener\">LogMeOnce password manager<\/a>. The Premium plan is $0.00 per month, Professional is $2.50 per month, Ultimate is $3.25 per month and Family is $4.99 per month, as published when we last checked. Dark Web Monitoring is $1.67 per month, and Family Dark Web Monitoring is $3.34 per month. You can compare every personal option on the <a href=\"https:\/\/logmeonce.com\/pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">pricing and comparison page<\/a>.<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/csuxjmfbwmkxiegfpljm.supabase.co\/storage\/v1\/object\/public\/blog-images\/organization-6456\/1760417791460_logmeonce.jpg\" alt=\"Logmeonce\" title=\"\"><\/p>\n<p>For companies, Teams is $4.00 per month per user and Business is $7.99 per month per user. Enterprise pricing is not published, so see the <a href=\"https:\/\/logmeonce.com\/business-pricing-and-comparison\" target=\"_blank\" rel=\"noopener\">business plans<\/a> to get in touch. To learn more about our wider approach, visit our <a href=\"https:\/\/logmeonce.com\/cybersecurity\" target=\"_blank\" rel=\"noopener\">cybersecurity hub<\/a>.<\/p>\n<h2 id=\"faq\"><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3 id=\"what-is-the-difference-between-phishing-and-ransomware\"><span class=\"ez-toc-section\" id=\"What_is_the_difference_between_phishing_and_ransomware\"><\/span>What is the difference between phishing and ransomware?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Phishing is a deceptive message designed to make you share information or open something harmful. Ransomware is malware that locks your files or systems and demands payment. Phishing is often how ransomware arrives, but phishing can also simply steal your passwords or trick you into sending money.<\/p>\n<h3 id=\"what-is-the-difference-between-phishing-and-malware\"><span class=\"ez-toc-section\" id=\"What_is_the_difference_between_phishing_and_malware\"><\/span>What is the difference between phishing and malware?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Phishing is the scam: the lure and the deception. Malware is the harmful software that a phishing link or attachment can install. CISA treats them as separate threats, and one frequently delivers the other. Ransomware is a specific kind of malware.<\/p>\n<h3 id=\"can-ransomware-infect-me-without-phishing\"><span class=\"ez-toc-section\" id=\"Can_ransomware_infect_me_without_phishing\"><\/span>Can ransomware infect me without phishing?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes. Attackers also exploit unpatched software and exposed remote-access tools, and they use stolen credentials bought or collected elsewhere. That is why updates, multi-factor authentication and backups matter just as much as spotting suspicious emails.<\/p>\n<h3 id=\"is-ransomware-considered-a-data-breach\"><span class=\"ez-toc-section\" id=\"Is_ransomware_considered_a_data_breach\"><\/span>Is ransomware considered a data breach?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>It is often treated as one, and you should plan on that basis. Under HIPAA, HHS has said a ransomware attack will typically count as a breach unless a low probability of compromise can be shown. Other laws differ, so check your obligations with legal counsel.<\/p>\n<h3 id=\"should-i-pay-the-ransom\"><span class=\"ez-toc-section\" id=\"Should_I_pay_the_ransom\"><\/span>Should I pay the ransom?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Talk to law enforcement and incident-response professionals before deciding. Paying does not guarantee your data returns, and stolen data may still be leaked. Good, tested backups are what keep you from having to face the question.<\/p>\n<h2 id=\"sources\"><span class=\"ez-toc-section\" id=\"Sources\"><\/span>Sources<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><a href=\"https:\/\/www.cisa.gov\/topics\/cyber-threats-and-response\/malware-phishing-and-ransomware\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Malware, Phishing, and Ransomware, CISA<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/sites\/default\/files\/2023-10\/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing Guidance: Stopping the Attack Cycle at Phase One, CISA and partners<\/a><\/li>\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing attacks: defending your organisation, NCSC<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/stopransomware\/ransomware-faqs\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Ransomware FAQs, CISA<\/a><\/li>\n<li><a href=\"https:\/\/www.secretservice.gov\/investigations\/ransomware\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Ransomware, U.S. Secret Service<\/a><\/li>\n<li><a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/ransomware\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Ransomware, NIST Small Business Cybersecurity<\/a><\/li>\n<li><a href=\"https:\/\/www.nist.gov\/itl\/smallbusinesscyber\/guidance-topic\/phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Phishing, NIST Small Business Cybersecurity<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/secure-our-world\/recognize-and-report-phishing\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Recognize and Report Phishing, CISA<\/a><\/li>\n<li><a href=\"https:\/\/www.cisa.gov\/stopransomware\/ransomware-guide\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">#StopRansomware Guide, CISA<\/a><\/li>\n<li><a href=\"https:\/\/www.ncsc.gov.uk\/guidance\/mitigating-malware-and-ransomware-attacks\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">Mitigating malware and ransomware attacks, NCSC<\/a><\/li>\n<li><a href=\"https:\/\/www.hlc.com\/en\/publications\/hhs-issues-new-guidance-on-ransomware-and-hipaa\" rel=\"nofollow noopener noreferrer\" target=\"_blank\">HHS Issues New Guidance on Ransomware and HIPAA<\/a><\/li>\n<\/ul>\n\n<div style=\"font-size: 0px; height: 0px; line-height: 0px; margin: 0; padding: 0; clear: both;\"><\/div>","protected":false},"excerpt":{"rendered":"<p>Phishing is how many ransomware attacks begin. Learn how the two connect, the warning signs to catch, and the layered defenses that stop the chain early.<\/p>\n","protected":false},"author":0,"featured_media":248466,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-248464","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-logmeonce"],"acf":[],"_links":{"self":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248464","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/comments?post=248464"}],"version-history":[{"count":1,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248464\/revisions"}],"predecessor-version":[{"id":248465,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/posts\/248464\/revisions\/248465"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media\/248466"}],"wp:attachment":[{"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/media?parent=248464"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/categories?post=248464"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/logmeonce.com\/resources\/wp-json\/wp\/v2\/tags?post=248464"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}