Keep systems updated to prevent ransomware attacks

Many ransomware infections start with software that should have been updated long ago. This guide explains how to prevent ransomware attacks with timely updates and solid backups, and where tools like Hide Expert VPN fit into your security routine.

How outdated software lets ransomware in

Ransomware is malware that encrypts files or locks systems and demands payment to restore them. Attackers need a way in, and known flaws in old software are one of the easiest. Once a vendor releases a fix, details of the vulnerability become public, and criminals scan the internet for systems that still haven't installed it.

Common entry points include unpatched operating systems, outdated browsers and plugins, old email and web servers, and remote access services exposed to the internet. Website owners face the same problem: attackers have used outdated WordPress plugins to plant backdoors on thousands of sites.

The WannaCry lesson

The WannaCry outbreak in May 2017 is the classic example. It spread through a Windows file-sharing vulnerability that Microsoft had patched about two months earlier. Computers without the update were hit, including systems at NHS hospitals in the UK and at the Spanish telecom company Telefonica, and an estimated 230,000 computers were infected within days.

The fix already existed. The missing step was installing it.

A case study: lost emails on an outdated platform

In 2023, Sri Lanka's Information and Communication Technology Agency (ICTA) reported a ransomware attack on government email using the gov.lk domain. ICTA chief executive Mahesh Perera explained that the service ran on an outdated 2013 email platform, and earlier upgrade attempts had stalled over funding and design issues.

The attack in late August encrypted emails and online services, including backups. ICTA restored the system from an offline backup about two and a half months old, so emails received in that period were lost for good. The agency reported the incident to the Sri Lanka Computer Emergency Readiness Team (SLCERT) and the police, and it called on all government institutions to keep their systems updated and properly maintained.

Two lessons stand out: outdated platforms are hard to defend, and backups only help if attackers can't reach them.

How to prevent ransomware attacks with updates

Turn on automatic updates

Enable automatic updates for operating systems, mobile devices and browsers wherever possible. For systems that need testing before an update, set a fixed schedule and a short deadline.

Patch actively exploited flaws first

Not every update is equally urgent. Fixes for vulnerabilities already used in attacks – like the zero-day flaws patched by major vendors – should be installed first, ideally within days.

Cover the less visible software

• Browser extensions, plugins and content management systems
• Routers, firewalls, network storage and other device firmware
• Email servers, VPN gateways and remote desktop services
• Third-party libraries inside your own applications

Replace end-of-life systems

When a vendor stops releasing security updates, every new flaw stays open. Keep an inventory with support end dates and plan replacements before they are due – the ICTA case shows how costly delays can be.

Update every platform

Ransomware isn't only a Windows problem. Researchers have found ransomware built for macOS, and phones can be targeted too, so keep every device on its latest supported version.

Other layers that limit the damage

Updates close known holes, but ransomware defense, like any corporate cybersecurity program, needs several layers:

• Offline backups. Follow the 3-2-1 rule – three copies, on two types of media, one off-site or offline – and test restores regularly.
• Least privilege. Everyday accounts shouldn't have admin rights, which limits what ransomware can encrypt.
• Multi-factor authentication on email, remote access and admin accounts.
• Email filtering and training, since phishing remains a common way to deliver ransomware.
• Safer remote access. Don't expose remote desktop directly to the internet. On public networks, a VPN encrypts traffic between your device and the VPN server, but it doesn't stop malware you download, so it complements updates and antivirus rather than replacing them.

If you suspect an infection

Disconnect the device from the network right away and check other devices on the same network. Run a full scan with up-to-date security software before you reconnect – on a Mac, follow our guide to scan for malware and remove it. Report the attack to the relevant authorities. Law enforcement agencies generally advise against paying the ransom, since payment doesn't guarantee you will get your files back.

Conclusion

Ransomware often succeeds through known flaws that already have a fix. Turn on automatic updates, patch actively exploited vulnerabilities first, replace unsupported systems and keep offline backups you have tested – together, these steps go a long way to prevent ransomware attacks.