The files won’t open, and there’s a message on the screen asking for payment.
Here is what to do in the first hour, in order.
The first hour
- Disconnect the affected computers from the network. Unplug the cable and turn off Wi-Fi. If you can’t disconnect a computer, turn it off. Don’t wipe it or reinstall anything.
- Photograph the message on the screen with your phone, including any email address, website, or ID number. Write down the time you first noticed.
- Tell your staff to stop using the computers and not to open the files.
- Don’t reply to the message, and don’t pay anything yet. Paying is a decision to make with advice, not in the first hour.
- If you have a cyber insurance policy, call the claims number on it. Some policies name the responders you are to use, so ask before you hire anyone.
- If money moved, call your bank’s fraud department the same day.
- Report it to the FBI’s Internet Crime Complaint Center at ic3.gov.
- Call us.
What we do
We start with what’s affected and what you have to restore from, and we tell you what we found and what we didn’t, with dates. If your insurer requires its own responders, we work alongside them.
Whether your backups can be restored is the question that decides how the next days go, and the first hour is for protecting the answer.
Talk to a person about what you noticed.
Call (•••) •••-••••
Kristina or Anne will answer. Available during US Eastern time.
While you wait: run the Reveal Scan on the computer you use for this.
Run the Reveal Scan on that computerThe Reveal Scan shows every problem it finds, with no charge and no credit card needed. Step-by-step instructions for fixing them are in the detailed report, which is paid, and you’ll see its price before you buy. It reads one Windows computer at a time and can’t see a mailbox.
Or ask for a call back. Tell us which computer or mailbox, and what you noticed.
Request a call back
Written by Craig Peterson, 35+ years successfully running IT and security for businesses. Last reviewed October 27, 2026.