The threats posed by Ransomware have been with us now for over two decades, and as observed in Q4/24, and Q1/25 the success rate of these attacks have grown in strength-to-strength, overcoming expensive, supposedly robust Digital Defences which have been deployed by big name brands such as Harrods, Tesco, M&S, and the CoOp who all fell victim to attacks in 2025 – these joining many others who have suffered at the hands of Hackers, State Sponsored Actors, and Criminals.

To understand the rationale behind the attack, the danger must be appreciated, not as a matter of an attack carried out using software (as was suggested in National Press in April 2025). To appreciate what a Ransomware attack, it is necessary to consider the multiples of aggregated components which may be leveraged to mount a successful attack, including but not limited to the precursor of Open-Source Intelligence (OSINT), Digital Footprinting, Social Engineering, Vulnerabilities, and Incident Response.

Looking back at Ransomware attacks I have engaged with, I may share the exposed areas which were overlooked, the existent holes in the Incident Response Process, and the importance of deploying both Proactive and Reactive measures to enhance the potentials of recovery in the form of Encryption, Run-Books and Training