Suspected Ransomware? Your First 30 Minutes, Step by Step

Files won't open, extensions look wrong, or a ransom note has appeared on screen — if you suspect ransomware, do three things immediately: disconnect from the network (do not power off), don't touch anything else, and call a specialist. Below are concrete steps for each, plus a list of things you should never do right after an infection.

- 1. Disconnect from the network: unplug the Ethernet cable or turn off Wi-Fi. Do not power off the machine
- 2. Don't touch anything: don't open files, don't reboot, and don't follow instructions on any ransom screen
- 3. Call a specialist: notify your internal IT contact or maintenance vendor first, then escalate to a public advisory service or police cybercrime unit if needed

- File extensions have changed to something unfamiliar
- The desktop wallpaper or screen has been replaced with a ransom demand
- Files won't open, or large numbers of files are being modified or encrypted at once
- Unfamiliar pop-ups or threatening messages appear
- The machine suddenly slows down, or network traffic spikes abnormally
- Files on shared folders or file servers also stop opening at the same time

- Force a shutdown: this can erase information in memory that would otherwise help investigate the scope of infection or recovery options
- Contact the attackers or pay the ransom: payment is no guarantee of decryption, and paying has in some reported cases led to being targeted again
- Run a free decryption tool on your own judgment: misidentifying the ransomware variant can permanently destroy files beyond any possibility of recovery
- Delete or overwrite logs and files: this destroys evidence that may be needed to determine the scope of damage or for any later investigation

- Wired connections: physically unplug the Ethernet cable from the machine
- Wi-Fi connections: turn off Wi-Fi in the OS settings (enable airplane mode too if you're unsure)
- Shared folders or NAS: stop other devices from accessing the affected folder, and disconnect the NAS itself from the network if possible
- Cloud sync (OneDrive, Google Drive, etc.): pause syncing to prevent encrypted files from propagating to other devices or the cloud
- Other devices on the same network: temporarily disconnect them too, to prevent the damage from spreading beyond the infected machine

Having a backup doesn't mean you should restore it right away. If the infection source and scope haven't been identified yet, restoring can simply let the same vulnerability get exploited again. It's best to work with your maintenance vendor or a specialist first to (1) identify and remove the infection source, (2) confirm the backup itself isn't compromised, and (3) put monitoring in place after restoration. If you keep multiple backup generations, check whether you can select one from before the infection occurred.

Once the immediate response has settled down, you'll need to assess the full scope of the incident and work on preventing a recurrence. If personal or client data may have been exposed, our related guide on what to do when a data breach is discovered covers those steps, and our ransomware basics guide for small businesses covers background and everyday preparedness.