Disconnect, don’t shut down
Unplug the network cable and turn off Wi-Fi on the affected computer. Leaving it powered on can preserve useful information. Don’t delete files or run cleanup tools yourself.
Tell the right people
Let whoever manages your IT know immediately, then your owner or manager. Speed matters more than blame.
Check what else is connected
Note which other computers, shared drives and cloud accounts the affected user could reach. These may need checking too.
Don’t engage with the attacker
Don’t reply to or pay anyone before getting advice. Take a photo of any message on the screen.
Locate your backups
Find out where your backups are and when the last good one was made. If a backup is connected to the infected network, keep it disconnected until it’s been checked.
Change passwords from a clean device
Once you have advice, change important passwords and turn on multi-factor authentication from a device you trust.
General information, not a substitute for professional advice about your specific situation.
