EMERGENCY RESPONSE GUIDE

Quick response guides for common digital emergencies

1 Contain / 2 Recover / 3 Prevent

1 Contain

Stop the damage immediately

  1. Disconnect from the internet: Pull the ethernet cable or turn off Wi-Fi immediately. This stops the spread and halts data exfiltration.
  2. Do NOT pay a ransom: Payment doesn’t guarantee recovery and funds criminal operations.
  3. Document everything: Photograph any ransom notes or error messages from your phone, not the infected computer.
  4. Secure your accounts: Change passwords for important accounts (bank, email) from a DIFFERENT, clean device.
  5. Isolate external storage: Do not plug USB drives or external drives into the infected machine. They can be encrypted or infected too.

2 Recover

Get back to normal

  1. Scan in Safe Mode: Boot into Safe Mode and run a full antivirus scan (Windows Defender, Malwarebytes, or Bitdefender). Run multiple scans with different tools for thoroughness.
  2. Check for free decryptors: For ransomware, visit nomoreransom.org to search for free decryption tools matching your specific ransomware strain.
  3. Restore from backup: Recover files from your external drive or cloud backup, but only AFTER confirming the malware has been fully removed.
  4. Try data recovery: If you have no backup, attempt data recovery software before resorting to a full system wipe.
  5. Update everything: After cleanup, update your OS and all software to the latest versions to close the vulnerabilities that may have been exploited.
  6. Change all passwords: Reset passwords for any accounts you accessed on the infected machine. Credentials may have been silently captured.

3 Prevent

Stop it from happening again

  • Find the entry point: Identify how the malware got in (phishing email, malicious download, unpatched software, or infected USB) so you can avoid it next time.
  • Keep software updated: Many attacks exploit known, already-patched vulnerabilities. Enable automatic updates for your OS and applications.
  • Use real-time antivirus: Keep antivirus protection active and its definitions current.
  • Follow the 3-2-1 backup rule: Maintain 3 copies of your data, on 2 different media types, with 1 copy offline or offsite.
  • Never enable macros in documents from untrusted sources.
  • Download from official sources only. Avoid pirated software, random “codec” installers, and unverified links.
  • Enable Windows Controlled Folder Access to block unknown programs from modifying your Documents and Pictures folders.

Key Contacts

Outside the United States? View international reporting resources

Sign up for monthly reminders

Protect yourself with monthly updates highlighting recent hacks, common scams to watch out for, and emerging threats.