What to do if you see a ransom note

In the first minutes

1. Disconnect affected computers from the network. Unplug the network cable and turn off Wi-Fi. This can stop the spread.
2. Do not turn them off. Evidence in memory can help investigators, and some recovery tools need it.
3. Call your IT provider immediately, by phone.
4. Do not contact the attackers or pay before talking to your IT provider and, if you have one, your insurer.

In the first hours

• Take a photo of the ransom note and anything else on screen.
• Tell your insurer if you have cyber coverage. They often need to be involved early and may provide specialists.
• Report it to the FBI. CISA’s StopRansomware site explains how.
• Make a list of what is affected and what still works.

What comes next

Your IT team will work out how the attackers got in, make sure they are out, and restore from backups the attack did not reach. Restoring before the way in is closed risks being encrypted again.

Before it ever happens

Write down who to call and keep the list on paper, because email and files may be unavailable. A short plan made calmly beats a long one made in a crisis.