A ransomware message can create pressure to act immediately: restart the computer, reconnect a backup, call a number in the note or pay before a deadline. The safer first goal is narrower: stop the incident from spreading and preserve recovery options.
This checklist is general guidance for a home, home office or small business. A serious business incident may require an IT incident responder, cyber-insurance contact, attorney, law enforcement and other specialists. Do not assume one computer is the only affected system.
1. Disconnect the affected device from the network
Unplug its Ethernet cable and turn off Wi-Fi and Bluetooth if you can do so without navigating through suspicious prompts. Disconnect external drives that are attached to the affected computer. Do not connect a backup drive to “see if the files are okay.” A running infection may encrypt or damage newly attached storage.
CISA advises powering a device down only when it cannot be disconnected from the network, because shutting down can affect evidence used during investigation. If this is a business system, note the time, the username and what was visible before changing anything.
2. Isolate other systems that show signs
Look for the same ransom note, renamed files, inaccessible shared folders, unexpected extensions, disabled security tools or unusual login alerts on other computers and servers. Disconnect affected systems. Avoid logging in to sensitive accounts from a computer that may be compromised.
If a shared cloud or network folder is changing rapidly, an administrator may need to pause synchronization or isolate the service. Do not delete accounts, logs or devices in panic; those details can help determine what happened.
3. Preserve basic evidence
Photograph the ransom note and record the exact filename, extension, date, time and device name. Keep suspicious emails, messages and attachment names. If you have security alerts, save their timestamps and detection names. Do not contact the attacker from a personal account or provide identification, payment details or credentials.
CISA’s response checklist recommends system triage and preservation of volatile evidence when possible. For a business, let the incident lead decide what should be captured before a reset or restore.
4. Notify the right people
For a business, contact the person responsible for IT and the cyber-insurance carrier before hiring vendors or negotiating; a policy may specify approved providers and reporting steps. Consider reporting the incident to the FBI Internet Crime Complaint Center and CISA through the reporting paths linked from StopRansomware.gov. If regulated, customer or employee information may have been exposed, obtain appropriate legal and compliance guidance.
A ransom note does not prove whether data was stolen. Treat encryption and data exposure as separate questions until evidence clarifies them.
5. Change credentials from a known-clean device
Use a different, trusted device to protect important accounts, starting with email, identity-provider, backup, remote-access and administrator accounts. Change compromised or reused passwords, revoke suspicious sessions and confirm multi-factor authentication. Review unfamiliar forwarding rules and recovery details. Our guide to unexpected email forwarding rules explains one account-level check.
Do not change passwords on the infected computer; new credentials could be captured.
6. Verify backups before restoring
A backup is valuable only if it is separate from the incident, complete enough for the required systems and tested. CISA recommends offline, encrypted backups and regular recovery testing. Identify the last known-good restore point and check whether the backup console itself shows unusual deletions, changed retention or failed jobs.
Restore into a clean environment after the affected system has been rebuilt or cleared by a qualified responder. Restoring files onto a still-compromised device can repeat the incident. If your files currently rely on cloud synchronization alone, read our guide to cloud sync versus backup before choosing a recovery path.
7. Do not treat payment as a recovery plan
Paying does not guarantee a working decryption key, complete file recovery or deletion of stolen data. It can also create legal and sanctions concerns. Decisions about payment should involve qualified incident, legal and insurance guidance—not a promise made under a countdown timer.
8. Rebuild, restore and monitor
Recovery may include reinstalling the operating system, closing the original entry point, applying updates, resetting credentials, restoring validated data and watching for renewed activity. Keep clean and affected systems separated until the response plan says they can reconnect.
Managed security can add monitoring and response for supported devices, but no plan guarantees that ransomware cannot occur. Level 2 and Level 3 include 24/7 MDR (Managed Detection and Response); MDR is security monitoring and response, not unlimited human support or a replacement for tested backups and incident-specific recovery. Compare our managed computer security levels and managed cloud backup options, then contact us if you need help choosing coverage for supported devices.