What to Do If You’re Infected
Learn the first response steps after a suspected ransomware infection.
Disconnect from the Internet
- Isolate the infected device to prevent the ransomware from spreading to other devices on your network.
Don’t Pay the Ransom
- There’s no guarantee the attacker will provide the decryption key, and paying encourages further attacks.
Contact Authorities
- Report the attack to local law enforcement or cybersecurity agencies.
Restore from Backup
- If you have a recent backup, wipe the infected device and restore your files.
Seek Professional Help
- Cybersecurity experts can assist in recovering your files or removing the ransomware.
Key Takeaways
- Disconnect affected devices from the network.
- Do not rush to pay the ransom.
- Document the message and seek trusted recovery help.
Practice Exercise
Write a simple incident response note with who to contact and what to disconnect.