What to do when cyber attacks disrupt your organisation
How to recover from disruption, get ready for future incidents and make them less likely.
What you need to know about ransomware
Understanding what ransomware is, how to identify it, and how to respond if you’re a victim of ransomware.
Experienced a ransomware attack?
If your organisation has experienced a cyber incident and is based in the UK, you can report it.
How do I know if it's ransomware?
In a ransomware attack, you won't be able to access your device and the data stored on it because the files are encrypted.
Usually you're asked to contact the attacker via an anonymous email address or follow instructions on an anonymous web page, to make payment in a cryptocurrency. The attackers may also threaten to leak the data they steal.
How does ransomware work?
- 1
Access
Attackers gain access to your network. They establish control and plant malicious encryption software. They may also take copies of your data and threaten to leak it.
- 2
Activation
The malware is activated, locking devices and causing the data across the network to be encrypted, meaning you can no longer access it.
- 3
Ransom demand
Usually you will then receive an on-screen notification from the cyber criminal, explaining the ransom and how to make the payment to unlock your computer or regain access to your data.
Payment is usually demanded via an anonymous web page and usually in a cryptocurrency, such as Bitcoin
Actions to take
If your organisation has experienced a ransomware attack there are actions you can take.
Should I pay the ransom?
The NCSC and UK law enforcement do not encourage, endorse nor condone the payment of ransom demands. But know that if you do pay the ransom:
- there is no guarantee that you will get access to your data or computer
- your computer will still be infected
- you will be paying criminal groups
- you're more likely to be targeted in future
For this reason, it is important that you always have a recent offline backup of your most important files and data.
Read our guidance to find more information for organisations considering payment in ransomware incidents.
Respond and recover from ransomware
How you or your organisation responds to and recovers from ransomware will hugely affect the impact of an attack. Take a look at our guidance to help you respond and recover.
Guidance on effective communications in a cyber incident
Supporting organisations of all sizes to manage their communications strategy before, during and after a cyber security incident.
Putting staff welfare at the heart of incident response
Guidance for staff responsible for managing a cyber incident response within their organisation.
Guidance for organisations considering payment in ransomware incidents
Advice for organisations experiencing a ransomware attack and the partner organisations supporting them.
The NCSC recommends that all UK organisations should use an NCSC-assured Cyber Incident Response provider when dealing with cyber incidents. This includes, but is not limited to, businesses from small, local companies to large, multi-national organisations, central and local government, and charities.
Cyber Incident Response
Members of this scheme offer NCSC assured Cyber Incident Response services to a wide range of organisations.
Find an assured Cyber Incident Response provider
There are two levels of NCSC Assured Cyber Incident Response that can help organisations recover from an incident. NCSC Assured Service Providers operating at the technical standard required for CIR Enhanced Level will also be technically competent in providing the incident response services required by CIR Standard Level. If unsure of which level to select, see Information for buyers section.
Help protect everyone
Download and print our ransomware poster to help protect your colleagues.
Prevent and protect against ransomware
Attackers will likely threaten to publish data if payment is not made. To counter this, you should take measures to minimise the impact of data theft. Take a look at our guidance that will help prevent you or your organisation experiencing a ransomware or other kind of cyber attack, and ultimately protect the data that is important to you.
Mitigating malware and ransomware attacks
How to defend organisations against malware or ransomware attacks.
Data security
Protect data where it is vulnerable.
Protecting bulk personal data
Fifteen best-practice measures to protect digital bulk data.
Incident management
How to effectively detect, respond to and resolve cyber incidents.
Monitor and detect ransomware
As well as preventing and responding to ransomware, it is also important for organisations to carry out monitoring and detection on their networks. Take a look at our guidance for organisations.
