Ransomware encrypts your files and demands payment — usually in crypto — to unlock them. The pop-up is designed to make you feel like paying is the only option. It's not.
Step 1 — Disconnect immediately. The moment you see the ransom message, unplug from the internet and disconnect from Wi-Fi. Unplug your router too. Ransomware spreads to every connected device it can find. Stopping the spread is more important than anything else in the first 60 seconds.
Step 2 — Don't pay. Paying funds criminal organizations, doesn't guarantee you get your files back (many victims pay and get nothing), and marks you as someone willing to pay again. The FBI formally recommends against paying.
Step 3 — Check nomoreransom.org. This is a free database maintained by law enforcement and cybersecurity firms. If your specific ransomware variant has been cracked, they have free decryption tools. Many variants have been broken. Check before you give up on your files.
Step 4 — Report it. FBI Internet Crime Complaint Center at ic3.gov. Individuals can and should report. These reports feed active investigations.
Step 5 — Restore safely. After containment and investigation, clean or rebuild affected systems and address compromised accounts and vulnerabilities. Then restore a verified backup into the clean environment. This is why the 3-2-1 backup rule exists: 3 copies of your data, on 2 different media types, with 1 stored offsite or in the cloud. A backup you never tested is not a backup.
Prevention is simple: keep your OS and software updated, don't click email attachments from unknown senders, and use reputable antivirus. Ransomware operators are lazy — they target the easiest victims.
Sources for this correction, checked October 17, 2026: https://www.cisa.gov/stopransomware/ransomware-guide ; https://www.ic3.gov/CSA/2023/230523.pdf