VPN and Ransomware: What Protection Is Realistic?

Ransomware has a simple, ugly business model: it encrypts the files on a computer or server and demands money for the key. When people hear that, many ask whether a VPN would have prevented it. The answer is almost always no, and it is worth understanding why, because the question hides a more useful one: what protection against ransomware is realistic, and where does a VPN fit?

This article looks at how ransomware attacks begin, the narrow places where a VPN touches the story, the surprising way that business remote-access VPNs can become the doorway, and the backup and account habits that actually decide the outcome. If you want the general idea of what a VPN does not cover, see what a VPN cannot protect you from.

How ransomware attacks usually begin

Ransomware does not appear from the network cable. It needs a way to run on a device you or your organisation control. The common starting points are:

• A malicious email attachment or link. A document, archive or link that looks like an invoice, a parcel notice or a job application. Opening it starts a chain that ends with the encryption program.
• A stolen or guessed password. An attacker signs in to a remote desktop, a mail account or a company system using a password leaked elsewhere or guessed, then installs the ransomware themselves.
• An exposed remote-access service. A computer or server whose remote-desktop or admin service is reachable from the whole internet gets scanned and attacked constantly.
• An unpatched flaw. An out-of-date operating system, file-sharing service, browser or network device with a known hole is exploited automatically.
• A fake or tampered download. Cracked software and modified installers sometimes deliver ransomware directly.
• A compromised supplier or tool. A trusted program or service that gets tampered with passes the problem on to its customers.

Look at what these have in common. The deciding moments are an unwise click, a weak or reused login, an open service and a missing update. None of them is a person reading your Wi-Fi traffic at a cafe. That is why a personal VPN, which protects traffic in transit, is not the main answer.

What a VPN is and is not in this story

A VPN encrypts the connection between your device and a VPN server, so people on the network in between cannot read or alter what you send. That is valuable for privacy on shared Wi-Fi, as the FTC explains in its guidance on public Wi-Fi networks. But ransomware is a program running on your device after it is already inside. At that point the connection is irrelevant.

Be precise about three things a VPN does not do.

1. It does not stop a program from running. If you open a poisoned attachment, the program runs whether or not a tunnel is active.
2. It does not detect or remove ransomware. That is the job of security software and the operating system's own protection. The comparison in VPN vs antivirus vs firewall shows who does what.
3. It does not restore your files. Only a backup does.

So the honest position is: a personal VPN is not a ransomware defence. It can be a sensible part of a tidy privacy routine, but it should not be what you spend your protection budget or attention on.

Where a VPN can matter: business remote access

For companies and small offices, VPNs enter the ransomware story in a different way, and this is the most useful thing to understand. Many organisations use a VPN to let staff reach internal systems from home. That VPN is a door into the company network. A door can be locked well or badly.

Setup	Ransomware risk	Why
Remote desktop open directly to the internet	High	Attackers scan for it all day and guess or reuse passwords
Remote access through a VPN with strong passwords and a second factor	Lower	The service is not an easy target and a stolen password alone is not enough
VPN with a single password and no second factor	Medium to high	A leaked password gives the attacker a way in
VPN appliance or software that is not updated	High	Known flaws in remote-access gateways are widely targeted
Staff devices that connect but are unmanaged or infected	Medium to high	An infected laptop can carry the problem through the tunnel

In plain words, a VPN is only as safe as its sign-in protection, its updates and the health of the devices that connect through it. Moving a risky service behind a well-run VPN with two-factor authentication usually reduces risk. Treating a VPN as a magic safe door that makes everything behind it trustworthy does not. This is also the thinking behind modern approaches such as zero trust, where a connection alone never counts as proof of trust. The US government publication on telework and remote access security covers the principles for organisations, and NIST's zero trust architecture guidance goes deeper. If you run a team, also read VPN for remote work.

The protections that carry the real weight

If you want to reduce ransomware risk in a realistic way, put effort in this order.

1. Backups that survive an attack

This is the single most important control. A useful backup plan follows a simple pattern:

• Keep at least three copies of important files: the original and two backups.
• Store them on two different kinds of media, such as an external drive and a cloud service.
• Keep one copy offline or version-protected, so an infected computer cannot overwrite or encrypt it. A drive that stays plugged in all day can be encrypted along with everything else.
• Test a restore every few months. A backup you have never restored is a hope, not a plan.

2. Updates

Turn on automatic updates for the operating system, browser, office programs and any network equipment such as your router. Many ransomware campaigns use flaws that were fixed long ago.

3. Sign-in protection

Use unique passwords and turn on two-factor authentication for email, cloud storage and any remote access. The US agency CISA describes why this matters in More than a Password, and our guide to two-factor authentication shows how to set it up.

4. Careful with email and downloads

Check the sender, be sceptical of urgent attachments, and download software only from official sources. CISA's page on how to recognize and report phishing is a good reference.

5. Limit what a single account can reach

Use a standard user account for daily work, not an administrator account. If ransomware runs under a limited account, it can encrypt fewer files and spread less far.

6. Security software

Keep the built-in protection of your operating system turned on, or use a reputable antivirus. These tools can block known ransomware families and suspicious behaviour, though no tool catches everything.

Three realistic situations

A family laptop. The Chaiya family shares one laptop with photos, school files and tax documents. The parents sometimes use cafe Wi-Fi with a VPN, which is sensible. But their real ransomware plan is an external drive that they connect only on Sundays to copy photos, plus a cloud folder for documents. If a bad attachment ever locked the laptop, they would restore from the copy that was not plugged in. The VPN is not part of that rescue.

A five-person design studio. The studio has a small file server and staff who sometimes work from home. They used to leave remote desktop reachable from the internet. Their consultant moved access behind a VPN, required a second factor for every person, set updates to automatic and added a nightly backup to a drive that is disconnected afterwards. Here the VPN did matter, but only together with the sign-in protection, updates and backups that surround it.

A freelancer on the road. Arnon uses a VPN on trains and in hotels. One day he opens an attachment from a client who has actually been hacked. His laptop starts encrypting files. The VPN could not help. What helped was that his documents sync to cloud storage with version history, so he could wipe the laptop and restore earlier versions of the files.

A one-evening readiness checklist

You do not need a security team to improve your position. Set aside one evening and work through this list, in order, ticking off each line.

1. List the files you could not bear to lose: family photos, documents, work projects, accounting files.
2. Find out where each of them lives today: one laptop, a phone, a cloud folder, a shared drive.
3. Make a second copy on an external drive, then disconnect the drive and put it away.
4. Turn on version history in any cloud storage you use, so earlier versions of a file can be recovered after a bad change.
5. Turn on automatic updates on every computer and phone, and install pending ones now.
6. Switch on two-factor authentication for email first, because email resets every other password.
7. Check your router: change the default admin password and install any available firmware update.
8. Switch your daily account to a standard user, keeping the administrator login for installs only.
9. Write down, on paper, who you would call if the computer locked up: a friend who knows computers, a local repair shop, or your company IT contact.
10. Put a date in your calendar three months ahead to restore one file from each backup as a test.

Notice that nothing on the list involves a VPN. If you also use one for travel or public Wi-Fi, add it afterwards as a separate privacy habit. For a small business, extend the list with two items: remove any remote-access service that is open to the whole internet, and require a second factor for every remote sign-in.

What to do if ransomware strikes

This is general information, not professional incident response, but a few steps are widely recommended.

1. Disconnect the device from Wi-Fi and cable immediately, to limit spread.
2. Do not plug in backup drives or switch on other devices until you know what is happening.
3. Take note of what you see, such as a ransom message and file name changes, with photos of the screen.
4. Contact IT support or a trusted professional. For a business, activate your incident plan.
5. Consider reporting to your national cyber-security or police authority, which may have guidance or recovery resources.
6. Change passwords from a clean device, starting with email and anything important.
7. Restore from a clean backup only after the device has been cleaned or rebuilt.

Decisions about paying or negotiating are serious, and are best taken with professional advice and local guidance. Nothing in this article is legal advice.

Common mistakes

• Believing a VPN protects the files on the device.
• Keeping the only backup on a drive that is always plugged in.
• Never testing a restore.
• Exposing remote desktop to the whole internet.
• Running a business VPN with a single password and no updates.
• Using an administrator account for everyday work.
• Opening an attachment because the sender's name looks familiar.
• Assuming small households and small businesses are too small to be targets.

Summary

A VPN does not stop ransomware, because ransomware runs on your device and a VPN protects traffic in transit. The place where VPNs genuinely matter is business remote access, where a poorly protected VPN or an exposed remote desktop can be the doorway. Realistic protection is a backup that an infected computer cannot touch, automatic updates, unique passwords with two-factor authentication, careful handling of email and downloads, limited accounts and reliable security software. Use a personal VPN for what it does well, which is privacy on networks you do not control.

If that kind of privacy layer fits your travel or shared Wi-Fi, you can look at the pricing page when you are ready.