What to do if you suspect ransomware

Ransomware locks or encrypts your files and demands payment. Fast, calm action by staff limits the damage.

1. Recognise the signs: files won’t open, odd file extensions, or a ransom note demanding payment.
2. Disconnect the device from the network immediately — unplug the network cable and turn off Wi-Fi.
3. Do not turn the machine off if you can avoid it, and do not pay any ransom.
4. Don’t try to delete files or ’fix’ it yourself — you may destroy evidence or make recovery harder.
5. Phone your IT team or provider straight away and report exactly what you saw.
6. Warn colleagues not to open the same email or file if you know how it arrived.