Ransomware: the first steps and who to call

Right now

1. Disconnect, don’t turn offUnplug affected computers from the network and turn off Wi-Fi, but leave them on. Shutting down can destroy evidence investigators need.
2. Call your cyber insurer’s hotline firstIf you have cyber insurance, call before you hire anyone. Many policies require using their approved responders, and paying someone else first can affect coverage.
3. Call your IT providerThey know your systems and backups.
4. Report itTo the FBI at ic3.gov or your local FBI field office, and to CISA. They may have information about the group involved.
5. Don’t contact the attackers yourselfLet the responders handle any communication.

About paying

The FBI advises against paying ransoms. Paying doesn’t guarantee you get your data back, and it can carry legal risk if the group is sanctioned. It’s a decision for you with your insurer, responder and attorney, not one to make alone in a panic.

What we can help with

For the computers themselves, use a ransomware specialist or your insurer’s responder. We’ll tell you that on the first call rather than learn on your emergency.

• If the attackers also got into your website, domain or email, that’s our incident response.
• Checking that your domain, DNS and email records weren’t changed during the incident.
• Afterward, closing the internet-facing gaps: two-step sign-in, email security, domain locks.

Before it happens

• Backups kept offline or separate, and tested.
• Two-step sign-in on email and remote access.
• Updates applied on office computers and network equipment.
• A printed list of who to call. Our who-to-call card works for this.