1. A method for mitigating the effect of a ransomware attack on an endpoint, comprising: detecting at least one access event associated with a request by a process to access at least one data item deployed in a file directory on the endpoint, the at least one data item being hidden from operating system processes executed on the endpoint, and the at least one data item, for which the access request was made, including data for baiting a ransomware process to access the at least one data item, such that, the ransomware process is the first process to request access to the at least one data item, and the at least one data item is the first data item in the file directory for which the ransomware process requests access; and responding to the detecting of the at least one access event by taking at least one action against the process associated with the detected access event.