Ransomware on a computer

Files won't open, their names have changed, or a ransom note is on screen. Act fast to stop it spreading, and don't try to fix it alone: ransomware is usually the last stage of a longer intrusion.

Get help Bring in an expert now if

Always, for ransomware. Call your incident response provider, your cyber insurer (they often require it and provide help) or your IT support partner now.
Report it to the police or your national cyber security centre: for example IC3 (FBI) in the US, or Action Fraud and the NCSC in the UK.

0 of 20 done

Right now

Disconnect affected machines from the network: unplug the cable and turn off Wi-Fi. Leave them powered on.
Powering off destroys evidence in memory. Only power off if you can't disconnect a machine.
If several machines are affected, take the network itself offline at the switch or firewall.
Coordinate by phone or in person, not by email or chat on the affected network.
Attackers may be reading company email and can react if they see you responding.
Photograph the ransom note and note the time, the machine name and who found it.
Don't contact the attackers or pay anything yet.
Paying doesn't guarantee your data back, may be illegal in some cases, and should be decided with your insurer and advisers.

Contain

Disconnect backups from the network and check they weren't touched.
Attackers target backups first. Offline or immutable copies are your way back.
Reset passwords for admin accounts and service accounts from a clean device, and turn on MFA where it's missing.
The attackers almost certainly had admin access before encrypting.
Block remote access (VPN, remote desktop) until you know how they got in.

Investigate

Work out which machines and shares are affected, and which aren't.
Save logs (and, if you can, disk and memory images) from affected systems before wiping or restoring anything.
Investigators and insurers need them, and they show how the attacker got in.
Look for new admin accounts, remote-access tools you didn't install, and disabled security or backup software.
These are how attackers come back after you restore.
Check No More Ransom (nomoreransom.org) for a free decryptor for this ransomware family.
Look for signs of data theft: large uploads, new cloud storage tools, or a note saying data was stolen.
Personal data may have been exposed: some laws set short deadlines to notify a regulator (72 hours under GDPR) or the people affected. Bring in whoever handles legal or privacy early.
Check suspicious IP addresses, domains and file hashes from logs or security alerts.
Open the IOC lookup

Recover

Rebuild affected machines from clean installs rather than trying to clean them.
Restore data from backups taken before the intrusion began, and scan it before it goes back into use.
Bring systems back gradually, watching for signs the attacker is still there.

Afterwards

Fix the way in (often an exposed remote desktop, an unpatched VPN or a phished password) before you're fully back online.
Keep at least one backup copy offline or immutable, and test restoring from it regularly.
Write up the timeline and lessons while they're fresh.

Sources and further reading

This checklist was checked against these public guides, which go into more depth. Bluebench isn't affiliated with them.

General guidance, not a substitute for your own incident response plan or professional help. Your ticks stay on this page only and aren't saved.