Your files are encrypted and there's a ransom note on screen? Instead of panicking — the right steps that limit the damage and make recovery easier.
Ransomware encrypts your files and demands payment to “unlock” them. Every minute counts: the malware can spread over the network to other computers and servers.
1. Disconnect the computer from the network
- Unplug the network cable and turn off Wi-Fi.
- Don’t rush to pull the power — memory may hold information that helps with analysis or recovery. Agree the next step with IT.
- If other computers show signs of the attack, disconnect them too — and the internet connection if necessary.
2. Tell IT immediately
Call your IT team or IT partner. Don’t try to “recover” files with tools downloaded from the internet — you may damage them permanently.
3. Don’t pay, and don’t talk to the attackers
Paying doesn’t guarantee you’ll get your files back, and the attack may happen again. Don’t contact the attackers before talking to IT and management.
4. Preserve evidence
- Take a photo or screenshot of the ransom note and the new file extensions;
- Write down when you noticed the problem and what happened just before (an opened attachment or link, for example).
5. Check your backups
With IT, check whether your backups are intact. The most reliable copy is offline or immutable. Only start restoring after the malware is removed — otherwise the files will be encrypted again.
💡 Tip: Prepare a one-page plan in advance — who to call, how to disconnect the network, where the backups are. During an incident there’s no time to think.
6. Change passwords
Change the passwords of accounts used on the infected computer — email, VPN, banking — from a clean device.
How to prevent it
- 3-2-1 backups, with one copy offline;
- MFA on email, VPN and admin accounts;
- Regular updates of systems and software;
- Phishing awareness for employees;
- Admin rights only for people who actually need them.
See how ready your backups are — take the backup check (10 questions).