Home Ransomware Incident Checklist
A calm checklist helps households contain encryption, protect accounts, and preserve the best chance of recovering important files.
Who this guide is for
Individuals whose home computer displays a ransom note or suddenly cannot open files.
Practical checklist
- Disconnect affected computers from Wi-Fi, Ethernet, shared drives, and removable storage.
- Photograph the ransom note and record filenames, extensions, times, and recent downloads.
- Do not rename encrypted files or run unknown decryptors on the only copy.
- Use a clean device to secure email, cloud storage, banking, and other priority accounts.
- Seek qualified recovery guidance and report the crime through the appropriate local channel.
Common mistake to avoid
Paying, wiping, or reconnecting backups before understanding what systems and files are affected.
A safer way to proceed
Contain the incident, document it, get trusted help, and restore only after the environment is clean.
Product features, prices, eligibility, and policies can change. Confirm important details on the provider’s official website before purchasing, renewing, changing account settings, or acting on a security alert. If an incident may involve financial loss, sensitive personal data, or a business network, consider qualified professional help and the appropriate official reporting channel.