If a device shows a ransom demand or you suspect an intrusion, stop ordinary work on it and leave existing backups disconnected. Reach qualified help through a separate known-clean channel. Do not plug in your archive to see whether you can rescue files. Immediate danger, urgent care and necessary communication come before this checklist; call 911 for an emergency.

If you are preparing before an incident, start with one device you are allowed to manage: privately note its provider or administrator and a verified support route. Unknowns can stay blank. You do not need to buy equipment, recruit a helper or map the whole household first.

Ransomware can deny access to data or systems, often by encryption, and may include theft or threats to release information. A household might notice a ransom note, changed file extensions, files that no longer open, unusual account alerts, unknown remote-control activity, or several devices behaving unexpectedly.

Those signs are not a do-it-yourself diagnosis. Hardware failure, ordinary corruption, account lockout, and other malware can look similar. The first objective is to limit additional damage without destroying evidence or contaminating recovery copies. A suspected ransomware incident needs qualified incident-response, provider, employer, insurer, and law-enforcement guidance as appropriate.

An open black file box with tan folders beside an open zippered pouch, plain card, gray external drive, USB stick and closed notebook on a wooden table.
Keeping an existing copy apart gives a responder another recovery question to check.

If ransomware is suspected now

  1. Stop normal work. Do not keep opening files, entering credentials, synchronizing folders, or running backups from the affected device.
  2. Disconnect the suspected device from networks when this can be done safely: unplug Ethernet and disable Wi-Fi and Bluetooth. Do not start exploring other devices to see what the malware can reach.
  3. Leave backup media disconnected. Do not attach an external drive, phone, camera card, or archive to test whether files can be copied.
  4. Do not power-cycle reflexively. Whether to leave a device on or turn it off can affect containment and evidence. Ask qualified incident-response help, employer IT, insurer, or law enforcement when available.
  5. Use a separate known-clean device to contact help through verified channels.
  6. Notify the owner. Employer or school IT controls managed devices and accounts; do not attempt personal cleanup first.
  7. Protect money and identity. Contact affected financial institutions promptly and use IdentityTheft.gov if personal information was misused.
  8. Document what was observed. Record time, device, visible message, affected accounts, recent alerts, and actions already taken. Photograph a screen only if safe; do not click through it.
  9. Report appropriately. The FBI directs online scam and internet-crime victims to the real IC3 site. Independently verify the exact IC3 address, not merely a page with “FBI” or “IC3” in its name or an arbitrary .gov address. The FBI warns that IC3 does not charge to recover funds or contact victims through social media.

These are precautions, not an instruction to complete every item in order before asking for help. Do not disconnect prescribed care, assistive technology or essential communication as a drill. Get the responsible administrator or qualified responder’s guidance when isolation itself could interrupt those functions. Do not delay an affected bank, employer or school notification to finish a record.

Call 911 for a physical threat, stalking, swatting threat, fire, medical emergency, or immediate danger. Digital extortion can overlap real-world risk.

Keep existing recovery options intact

Keep the response on verified channels and preserve the evidence that qualified responders may need:

  • Do not pay or negotiate based on generic advice. Payment does not guarantee recovery and can create legal, financial, sanctions, safety, and repeat-targeting concerns.
  • Do not treat the phone number in a ransom note as support.
  • Do not install a “decryptor,” antivirus, cleanup tool, or remote-support application offered by an unsolicited message.
  • Do not delete the note, suspicious files, logs, user accounts, or applications before qualified guidance.
  • Do not change every password from the suspected device or restore a backup onto a system whose integrity is unknown.
  • Do not assume one unaffected-looking device or cloud folder is clean.
  • Do not publicly post the household’s evidence, identity records, or negotiation details.

Prepare before an incident

Maintain isolated, tested backups

NIST emphasizes secure, isolated backups and a tested restoration strategy. Use the 3-2-1 household backup guide to keep multiple copies, an off-site path, version history, and at least one copy that is not continuously writable from the primary device.

Before an incident, record one known copy and one uncertainty privately, without identifiers, key values or precise secret locations in a shared checklist. Under normal authorized conditions, follow the actual backup system’s safe sample-restoration instructions while preserving originals and earlier copies. A successful sample checks that sample, not all data, future recovery or freedom from malware. Do not overwrite the only good copy or attach suspect media to rehearse recovery.

A backup can preserve already encrypted or compromised files if the problem predates the backup. Version history and identifying a usable recovery point matter. Being unplugged is not a guarantee: the copy may already be damaged, incomplete or compromised. During a suspected incident, leave restoration and media handling to qualified guidance.

Harden ordinary access

  • Keep operating systems, browsers, applications, routers, and security tools supported and updated.
  • Use unique credentials in a reputable password manager.
  • Enable MFA, prioritizing email, backup, financial, remote-access, and administrator accounts.
  • Review unfamiliar or unused applications, accounts, browser extensions and remote-access tools under the provider or administrator’s guidance. Do not delete evidence during an incident or remove the only usable access method as an exercise.
  • Use non-administrator accounts for ordinary work where practical.
  • Treat unexpected links, attachments, login prompts, invoices, delivery notices, and support calls as untrusted.
  • Keep device locks and official lost-device features configured.

Know what connects to what

For the one device you chose, note what you already know. A full map is optional; a blank is better than a guess.

One device and the questions to bring to qualified help
QuestionUseful private note
Who controls itYour permitted role or the responsible employer, school or provider.
What depends on itGeneral care, communication, work or household function, without private record contents.
What may connectKnown service or backup type; leave unknown connections blank rather than investigating.
How to reach helpVerified public support route from a separate known-clean channel.

This is a conversation aid, not a network-defense manual or permission to reset a router, erase a device or probe other systems. Keep original records, necessary recovery material and sensitive incident details separately protected. Follow the authorized responder’s actual containment instructions.

Prepare clean contact paths

On paper or a separately controlled device, keep:

  • employer or school IT contact;
  • insurer’s public incident-support number, with any necessary policy identifiers separately protected;
  • bank and card fraud numbers from statements or official apps;
  • device and backup provider names;
  • local qualified IT or incident-response contact if preselected;
  • FBI/IC3 and IdentityTheft.gov reporting references;
  • an authorized contact or optional helper, if one is available.

One verified route is enough to start preparation. Do not rely on search advertisements during an incident. Verify domains and phone numbers independently; no website badge or familiar logo proves a service legitimate. Keep credentials, identifiers, precise backup locations and evidence out of site forms, ordinary email and broadly shared notes. A legitimate reporting or support process may need private details through its verified channel.

Triage impact without investigating the attacker

Tell the responder what you already observed. Unknown details can stay blank; do not investigate to fill every field:

  • devices showing symptoms;
  • accounts reporting unknown access;
  • whether work, school, health, financial, or identity data was present;
  • backup locations and whether they were connected;
  • approximate first symptom and last known normal use;
  • recent unusual messages, downloads, software installs, or remote-support sessions;
  • whether the same credentials were reused elsewhere;
  • whether money or cryptocurrency moved;
  • whether a threat names the household or claims stolen data.

Do not hunt for malware, open samples, visit attacker sites, or search underground services. Those activities create additional risk and are outside household preparedness.

Recovery is a controlled rebuild

Qualified responders may need to preserve evidence, determine scope, identify a usable recovery point, rebuild or replace systems, reset accounts from clean devices, and validate restored data. Your role is to share known observations, preserve originals and avoid contaminating backups. You do not need a complete inventory before seeking help.

Before any restoration, ask the authorized responder about the questions that apply. Do not carry out these checks as a do-it-yourself incident test:

  1. who decided the device or environment is clean enough;
  2. which backup version is believed to predate the incident;
  3. whether the backup was isolated and scanned or validated appropriately;
  4. where recovery keys and installation media come from;
  5. which credentials must change and in what order;
  6. whether provider, employer, insurer, or law-enforcement requirements apply;
  7. how restored files will be checked before normal synchronization resumes.

Account recovery and replacement follow the actual provider and incident priorities, not a universal email-first sequence. From a known-clean channel, follow qualified instructions for exposed credentials, sessions, recovery methods and monitoring. Do not invalidate your only working factor, rotate every code or erase a device merely to test the plan. Some recovery material cannot be replaced in the same way as a password. The password recovery plan and offline credentials guide help prepare questions; they do not authorize incident cleanup.

Include people, not just computers

Ransomware can interrupt income, school, medical records, assistive technology, communication, family photos, and household administration. Keep necessary care and communication available while obtaining help. An authorized helper can share a task, but having a team is not a prerequisite. Do not shame the person who clicked or disclosed something; rapid, accurate reporting is more useful than blame.

Provide an offline path for critical care and communication records that does not require restoring the entire digital environment. The digital continuity hub helps prioritize those functions.

Keep public communication factual and limited. Do not repeat an attacker’s claims as confirmed facts, disclose whose personal data may be involved, or promise a restoration time before responders establish scope. If someone is authorized to update affected people, use a channel not controlled by the suspected account and follow applicable reporting duties. You can stop pre-event planning after one useful contact question; an optional reminder does not require a full restoration drill.

Sources reviewed

  • CISA, FBI, NSA, and MS-ISAC: StopRansomware Guide
  • NIST: Data Integrity, Detecting and Responding to Ransomware and Other Destructive Events; Ransomware Tips and Tactics
  • FBI: Contact Us; Warning About Spoofed IC3 Websites
  • Federal Trade Commission: IdentityTheft.gov

Historical source review: July 14, 2026. The NIST ransomware tips article and FBI warning about spoofed IC3 websites were checked October 3 for the specific isolated-backup and reporting-channel points. NIST’s organizational guidance supplies principles, not a household recovery guarantee; this is not a new full review of SP 1800-26 or the historical CISA records. This page is not incident-response authorization. Current provider, employer, insurer, law-enforcement, legal, and qualified responder instructions control the actual incident.