When ransomware breaches a system, it searches for and encrypts valuable files using asymmetric key encryption, so only the attacker has the private key to decrypt the files.