Signs it is ransomware
- Files have been renamed or have an unfamiliar extension, and will not open.
- A text file, web page, or wallpaper demands payment, often in cryptocurrency.
- Security software has been switched off, or the computer is unusually slow and busy.
Steps to take now
- Disconnect the affected computer from the network: unplug the network cable and turn off Wi-Fi. Only if you cannot disconnect it, shut it down.
- Check other computers and shared drives for the same symptoms, and disconnect any that are affected.
- Pause cloud sync (OneDrive, Dropbox, Google Drive) so encrypted files do not overwrite good copies. These services keep earlier versions that may be restorable.
- Photograph the ransom note and the renamed files. Do not delete encrypted files, reinstall the system, or run cleanup tools yet.
- From a different, unaffected device, change the passwords for email, banking, and admin accounts, and turn on multi-factor authentication.
- Call your cyber insurer if you have a policy. Many require prompt notice and some require their own approved responders, so check before hiring anyone.
- Report it to the FBI at ic3.gov.
Should you pay?
The FBI and CISA advise against paying. Payment does not guarantee you get your files back, and it does not remove the attacker from your network. Before deciding anything, find out what can be recovered from backups, cloud version history, and unaffected copies.
If personal information about clients or staff may have been exposed, talk to your attorney about notification duties.
Recovery and prevention
Recovery means restoring files from clean backups or version history, rebuilding affected computers, and closing the way in, which is often a reused password or a malicious email attachment. Afterwards, the protections that matter most are backups the attacker cannot reach, endpoint protection on every computer, multi-factor authentication, and prompt updates.
Case study: ransomware recovery in Culver City