Disconnect affected computers from the network immediately — unplug cables and turn off WiFi — but don't turn them off or wipe them. Then call IT support, your cyber insurance provider if you have one, and report it. Don't contact the attackers or pay before getting professional advice.
Common causes
Phishing email
A malicious attachment or link is the most common way in.
Exposed Remote Desktop
Remote Desktop open to the internet is a frequent target.
Unpatched systems
Missing updates on computers, servers, and firewalls let attackers in.
Stolen passwords without MFA
Attackers use stolen credentials to sign in and spread.
How to fix it, step by step
- 1
Isolate affected computers
Disconnect them from the network and WiFi, and disconnect external drives.
- 2
Don't power off or wipe
Leave computers on but disconnected; evidence and recovery options can be lost.
- 3
Take photos of the ransom note
Record what you see for investigators and insurers.
- 4
Call IT support and your insurer
Many cyber insurance policies require you to notify them before taking further action.
- 5
Report it
Report the attack to the FBI's Internet Crime Complaint Center (IC3).
- 6
Check your backups
Determine whether clean, offline backups exist before deciding how to recover.
When to call a technician
Call immediately. We contain the attack, assess which systems are affected, recover from backups where possible, and help you rebuild securely — then put protections in place so it doesn't happen again.
On-site support across Orange County · see our IT support, managed IT, Microsoft 365 support and cybersecurity services.
Frequently asked questions
Should we pay the ransom?
Get professional advice first. Paying doesn't guarantee you get your files back and may have legal implications.
Can ransomware encrypt backups?
Yes, if backups are connected to the network. Offline or immutable backups protect against this.
How do small businesses prevent ransomware?
MFA, regular updates, email filtering, endpoint protection, staff training, and tested offline backups.