What should I do if I've been hit by ransomware?

Ransomware usually leaves three kinds of trace at once: many different file types carry the same unfamiliar appended extension (often with an ID and an attacker email address, or just a random string); ransom notes in .txt, .hta or .html format appear in the encrypted folders; and the wallpaper or a pop-up is replaced by a ransom message. On servers it typically comes with database and backup services being stopped, shadow copies deleted and security software switched off.

A few situations are easy to misread:

• Files won't open, but there is no common extension and no note. File association problems, a USB worm hiding the originals, encoding issues or disk failure are all possible; files renamed and won't open explains how to tell them apart. A handful of families do not rename files at all, so if files open as garbage, still look for a ransom note.
• Files are fine, but someone threatens to publish your data. That may be an extortion-only crew that steals without encrypting, and the response is quite different; see a ransomware gang threatens to leak our data.
• Nothing is encrypted, but a finance PC is being remotely controlled and "the boss" is asking for a transfer. That looks like the Silver Fox trojan: stop the payment and call the police first; see what to do about Silver Fox.

The default is to disconnect but keep the power on. Pulling the cable or isolating the switch port cuts the attacker's remote control and the path to other hosts while keeping the evidence in memory intact. Rebooting or shutting down costs you:

• Memory evidence. Processes, network connections, injected code and, for some families, residual key material exist only in RAM. During the 2017 WannaCry outbreak, the WanaKiwi tool recovered files by finding leftover prime numbers from key generation in the memory of hosts that were still running, and its documentation stressed not rebooting before trying it.
• Possibly more encryption. Some encryptors register themselves to run at startup.
• Overwritten remnants. Booting writes logs, temporary files and the page file, and the automatic disk check after an unclean shutdown can rewrite filesystem structures.

The one exception is when you can see encryption still in progress, important files have not been reached yet, and you cannot immediately disconnect the network or kill the process. The ransomware guide from China's national CERT (CNCERT) says that if important files are not yet encrypted, stop the ransomware process or shut the machine down to limit the loss, and if they are already fully encrypted, leave the machine running as it is for professional handling. CISA's response checklist likewise treats powering down only as the fallback when devices cannot be disconnected, and warns that it destroys evidence held in memory. The UK NCSC's July 2026 guidance also frames "disconnect or power down" as a decision that trades evidence against containment.

In practice, by the time most people notice, encryption has already finished, and shutting down then costs something and gains nothing. When in doubt, follow the default: disconnect, keep it powered on, and call for help.

For a company, the hard part is not one computer but scope and coordination:

• Appoint one incident lead and give technology, the business, legal and external communications a named owner each. Record every action in writing - time, person, rationale - because the police report, audits and insurance claims will all need it.
• Treat it as a hands-on intrusion. Families common in China such as Phobos, Makop and Mallox are mostly deployed by hand after the attacker brute-forces remote desktop or database passwords, usually after time inside the network and with privileged accounts in hand. Dealing only with the machine that reported the problem is nowhere near enough.
• Start business continuity in parallel. Decide which services must come back first and what manual process covers them until then.
• Move your communications. The UK NCSC advises establishing whether corporate channels are available and trustworthy, and switching to alternatives if they are not.

For encrypted databases, virtualisation platforms, NAS and ERP, and for estate-wide encryption after a domain controller is compromised, see the related solutions further down this page.

A personal computer is most often infected through cracked software, activation tools or game cheats, and the typical family is STOP/Djvu: a random four-lowercase-letter extension and a note called _readme.txt. Two things need extra attention. First, these infections often bring an information stealer: K7 Labs documented STOP/Djvu downloading Vidar before encrypting, which takes saved browser credentials, cookies and cryptocurrency wallets - so change email, banking and social media passwords from a different, clean device. Second, attached external drives and cloud-sync folders are likely to be encrypted too; pause syncing, then check the cloud service's web interface for earlier file versions.

Recoverability depends on the family and version, backups and snapshots, and whether encryption was complete. Broadly there are three situations. A small number of families have public decryptors thanks to law enforcement action or implementation flaws, usually valid only for specific versions. More commonly there is no decryptor, but a substantial share can be recovered from backups, storage and hypervisor snapshots, database file repair and unencrypted remnants. And sometimes files are fully encrypted and every backup is gone, and the data genuinely cannot be recovered - in which case we say so. For the detailed assessment see can encrypted files be recovered, and for where decryptors come from and how to spot fakes see ransomware decryption tools.

On the ransom: the No More Ransom project advises against paying, since there is no guarantee you will receive the key you need, and the UK NCSC's guidance states that law enforcement does not encourage, endorse or condone paying. The risks and compliance issues are covered in should we pay the ransom. We do not pay ransoms and do not negotiate on anyone's behalf; recovery comes from decryptors, backups and snapshots, database repair and fragment reconstruction.

Cost and duration depend on data volume, the number of systems and the recovery path; see ransomware recovery cost and time. Send us the extension and the ransom note and the first read on the family and the viable paths is free. If a full assessment needs access to the environment, imaging and trial repairs, whether it is chargeable is made clear and confirmed with you before it starts.

Yes, report it. Ransomware attacks are crimes, and a police report underpins later accountability, insurance claims and compliance explanations. In China that means the local public security bureau; channels and documents are covered in how to report ransomware to the police.

Organisations in China must also assess regulatory reporting. Under the Administrative Measures for National Cybersecurity Incident Reporting (国家网络安全事件报告管理办法), issued by the Cyberspace Administration of China and in force since 1 November 2025, a network operator that assesses an incident as "relatively major" or above must report within set limits:

• where critical information infrastructure is involved, to the sector protection authority and the police immediately, and within 1 hour at the latest;
• central and state bodies and their directly affiliated units, to their own cyberspace affairs office within 2 hours;
• all other network operators, to the provincial cyberspace administration where they are located within 4 hours.

Reports on ransomware incidents must also state the ransom amount demanded, the payment method and the date. The regulator runs the 12387 hotline and a web portal for reports. Whether an incident meets the threshold and exactly whom to notify should be confirmed with the authorities and your legal counsel. Where data was stolen and personal information is involved, notification duties need a separate assessment.

Foreign companies in China and organisations abroad may also have home-jurisdiction duties: CISA asks US organisations to report to CISA, a local FBI field office or the FBI's IC3, and UK organisations can report through the NCSC's incident reporting page.

Decide what to save first. CISA's checklist calls for triaging and rebuilding systems according to the priority of critical services, and the UK NCSC stresses that business needs must drive the recovery order. A common sequence:

1. Stand up a clean recovery environment separated from the infected network, and rebuild compromised systems rather than "cleaning and carrying on".
2. Restore infrastructure first - identity (domain controllers), DNS, networking and the backup platform - then core business systems, and general office services and archives last.
3. Validate backups before restoring: confirm the restore point predates the intrusion and contains none of the attacker's accounts or tools, and prefer offline copies.
4. Have business owners sign off samples before go-live, and re-enter missing increments from business records.

Before reconnecting to production, complete at least five things: close the confirmed entry point (typically remote desktop or database ports exposed to the internet, or unpatched edge devices); rotate every credential, including domain administrators, service accounts, database and VPN accounts; find and remove the attacker's accounts, scheduled tasks, services and remote-access tools; enable multi-factor authentication on remote access; and rebuild at least one offline or immutable backup.

The NCSC's July 2026 guidance warns that rushing recovery before the incident is understood significantly increases risk. Being encrypted again after restoring is the most common and most avoidable second loss. For why organisations get hit repeatedly and how to fix it for good, see repeated ransomware infections.