[FILES ENCRYPTED BY RANSOMWARE: WHAT TO DO]

• Disconnect the computer from the network — unplug the cable, turn off Wi-Fi. Ransomware encrypts shared folders and network drives too.
• Disconnect external drives and backup disks that are still plugged in, before they are encrypted as well.
• Do not turn the computer off yet if you are going to call a professional: memory can hold traces that help. If you are on your own, shutting down to stop the encryption is reasonable.
• At work, call IT immediately. Ransomware in a company is an incident for the whole network, not one computer.

Keep the ransom note and a couple of encrypted files — do not delete them. They identify the strain, and the strain decides everything else.

Upload the ransom note and one encrypted file to ID Ransomware, a free service run by security researchers. It recognises more than a thousand families from the note's wording, the file extension and the encrypted file's structure.

No More Ransom, run by Europol, national police forces and security companies, offers free decryptors for well over a hundred ransomware families. They exist when researchers find a flaw in the ransomware or when police seize the attackers' servers.

If there is no decryptor today, keep a copy of the encrypted files anyway. Decryptors are sometimes released months or years later.

• Backups made before the infection and kept disconnected are the surest way back. Restore only after the computer has been cleaned.
• Cloud version history. OneDrive, Google Drive and Dropbox keep earlier versions of synced files; with a Microsoft 365 subscription, OneDrive can even restore your whole OneDrive to a date before the attack.
• Windows shadow copies ("Previous Versions") sometimes survive, although most ransomware deletes them.
• Copies elsewhere: email attachments you sent, photos still on your phone, files on a colleague's computer.

• Reinstall the system rather than trusting an antivirus clean-up: attackers often leave other access behind.
• Change your passwords from a clean device, especially email and banking — many strains steal saved passwords before encrypting.
• Report it to the police or your national cybercrime service — in France cybermalveillance.gouv.fr, in the United States ic3.gov. Reports feed the investigations that lead to seized keys and new decryptors.

Police and security agencies advise against it. Payment does not guarantee a working decryptor, marks you as a target for a second attack, and funds the next one. In some countries paying a group under sanctions is itself illegal.

It is your decision, but make it last: only after checking for a free decryptor and every backup, and ideally with professional advice.