Updated
Quick fix
Prevent it with updates, MFA, careful email habits and backups that ransomware can’t reach. If it hits, disconnect affected computers from the network, don’t turn them off, and call your IT team before doing anything else.
Step by step
Prevent
Keep systems updated, turn on MFA, train staff to spot phishing and keep protected backups.
If you see a ransom note
Disconnect the computer from the network (unplug the cable and turn off Wi-Fi). Leave it powered on unless your IT team says otherwise; it may hold evidence.
Don’t use the computer
Don’t try to delete files or run cleanup tools on your own.
Call your IT team
Tell them what you saw and when. Take a photo of the screen.
Report it
Report the incident to the FBI at ic3.gov. If you have cyber insurance, contact your insurer early.
Restore from clean backups
Your IT team will make sure the threat is gone before restoring.