Digital & Data
Ransomware screen appears: what to do?
Ransomware screen appears: the right reflexes in a few simple steps.
Written by Mohamed IDBRAHIM · Updated octobre 13, 2026 · 7 min read
Immediate actions
- 1 Disconnect the device from the network immediately.
- 2 Do not pay the ransom — no guarantee of recovery.
- 3 Take a photo of the message for authorities.
- 4 Restore from backups or call a professional.
What not to do / warning
Paying ransoms funds criminals and rarely restores files.
When a ransomware screen appears happens, the first minutes matter. Follow these steps to act safely and without panic.
What to do right now
- Disconnect the device from the network immediately.
- Do not pay the ransom — no guarantee of recovery.
- Take a photo of the message for authorities.
- Restore from backups or call a professional.
Mistakes to avoid
- Acting before removing the immediate source of danger.
- Panicking or skipping the official procedures.
- Following unverified advice from the internet.
How to prevent this in the future
Regular checks and keeping important documents and numbers in one safe place go a long way. Note the emergency number for your country and keep it visible at home.
Frequently asked questions
What should I do first?
Ensure everyone is safe, remove the source of danger, then call the relevant number or start the official procedure.
When should I call emergency services?
Whenever there is a risk to life, serious injury or a fire. When in doubt, call and let them decide.
Sources & references
- CISA (https://www.cisa.gov/)