Ransomware? What to do in the first hour

Do this now

1. Disconnect affected devices from the network. Unplug the network cable and turn off Wi-Fi. Where you can, disconnect rather than switch off. Shutting down can destroy information that helps with recovery.
2. Disconnect your backups. Unplug backup drives and pause any syncing to the cloud, so the ransomware can't reach them.
3. Photograph the ransom note and any error messages with your phone. Don't delete the note or the locked files.
4. Check other devices on the same network for the same signs, and disconnect them too if they're affected.
5. Change important passwords from a clean device, starting with email, banking and any admin accounts.
6. If you have cyber insurance, call your insurer early. Many policies require you to report quickly and to use approved help.

Don't do this

• Don't contact the attackers or pay before getting advice. Paying doesn't guarantee your files come back, and it can mark you as a target for another attack.
• Don't plug in your backup drive to "check it" on an infected computer.
• Don't wipe or reinstall straight away. You may lose files that could be recovered, and you won't learn how the attackers got in.
• Don't run random "decryptor" downloads. Fake decryption tools are a common way to spread more malware.

How recovery works

1. Identify the ransomware. The note and the new file names usually reveal which kind it is. For some older kinds, free decryption tools exist, for example through the No More Ransom project.
2. Find how they got in. Common ways in are a phishing email, a reused or leaked password, or an unpatched remote access service. If this isn't fixed, they can come back.
3. Clean or rebuild affected devices, then update everything.
4. Restore from a clean backup, checking the restored files open correctly.
5. Report it to your local police or your national cybercrime reporting service. It helps others, and insurers often need the reference.

Protect yourself before it happens

• Keep at least one backup ransomware can't reach. That means offline or "immutable" (it can't be changed or deleted for a set time).
• Test a restore a few times a year. A backup you've never restored is a guess.
• Turn on multi-factor sign-in, especially for email, remote access and admin accounts.
• Keep devices and software updated, and remove remote access tools you don't use.
• Limit admin rights to the people and moments that really need them.

Our security assessment checks all of this, including whether your backups would survive an attack.