Recently, my employer blocked access to Gmail, Yahoo Mail, etc., because an employee downloaded an email attachment which contained ransomware and got their disk encrypted.  

QUESTION : How does ransomware get the root/admin permissions to encrypt your disk?  Presumably, the person who downloaded it had to have entered the admin/root password at some point.

Ransomware doesn't get root/admin permissions, because it does not need to.

It does not encrypt the disk or files protected by the operating system (executables, configuration, credentials), it encrypts files created and stored by the users (data); and all it requires to do so, is the same level of access as the users themselves.

Just like a user would create a password-protected zip and delete the original file, so does ransomware (except, it keeps the password in secret and makes sure the original file is really inaccessible).

That's the whole reason why ransomware is so successful, it encrypts what is the most valuable for users and companies: their work.
