What to do if you see a ransom note on a screen

Pull the network cable and turn off Wi-Fi on the affected computer. If you can't find the cable, unplug the network switch it connects to, or ask IT to disable the port. The aim is to stop the ransomware spreading to other machines and to file servers.

Leave the computer turned on. Memory holds clues that disappear when power is cut: the running malware, network connections, sometimes even encryption keys. Both the Canadian Centre for Cyber Security's ransomware playbook (ITSM.00.099) and the CISA #StopRansomware Guide put isolating affected systems at the front of the response. Shutting down is a decision for the responder, not a reflex.

• Use your phone to photograph the whole screen, including the note, file names and any desktop changes.
• Capture the ransom note's file name, any 'ID' or 'key' string, the email address, chat link or portal address, and the deadline.
• Note the time, the computer's name or asset tag, and who was using it.
• Don't click links in the note, open the chat portal, or contact the attackers.

1. 01

   Your IT lead or managed IT provider

   So they can start isolating systems and protecting backups.

2. 02

   Your incident responder

   Our 24/7 line is (289) 582-9930.

3. 03

   Your cyber insurer's claims or breach line

   If you have cyber coverage. Many policies set rules on which vendors you use and what you approve, so call before committing to costs.

4. 04

   Your lawyer

   For privilege, regulatory reporting and any decision about engaging with the attackers.

5. 05

   Senior management

   One decision-maker should own the response from here.

• Don't restart or shut down affected computers.
• Don't delete the ransom note or encrypted files, and don't try to rename files back.
• Don't run free 'decryptor' tools or antivirus cleanups before evidence is captured.
• Don't plug backup drives into anything until the responder says it's safe; ransomware deliberately targets connected backups.
• Don't restore from backup yet. You need to know how the attacker got in, or you may restore them too.
• Don't discuss the incident on company email or Teams if the attacker may have admin access.

Give staff a short, calm instruction, ideally by phone, text or in person: don't log in to the network until told, don't open shared files, report any other ransom notes or odd behaviour to one named person, and don't talk about the incident outside the company or on social media.

Have someone keep a log of every action taken and who took it, with times. It will be needed by your responder, insurer and lawyer.

Once the first 15 minutes are handled, a structured response begins: scoping which systems are affected, preserving evidence, finding how the attacker got in, determining whether data was stolen as well as encrypted, and planning recovery from clean backups. Modern ransomware groups often steal data before encrypting it and threaten to publish it, so the absence of a leak threat doesn't mean nothing left.

Reports can be made to the Canadian Centre for Cyber Security and to police and the Canadian Anti-Fraud Centre through reportcyberandfraud.canada.ca. Whether a privacy breach report is required depends on what personal information was affected. For the full sequence, see The first 72 hours of a cyber incident.