Beginner level · Module 5: Incident Response Basics · Lesson 2 of 3
Ransomware, Extortion and Reporting
Respond to ransomware and threats without making things worse.
In this lesson you will
- Respond to ransomware safely
- Report incidents to the right people
Key concepts
ransomwareextortionisolationreporting channels
The lesson
Ransomware encrypts files and demands payment. Disconnect affected devices from the network, do not turn them on and off repeatedly, and contact IT support.
Paying does not guarantee recovery and funds criminals; backups are the real defence. Extortion messages claiming to have embarrassing videos are usually bluffs — do not pay or reply.
Report to your organisation's IT contact, the affected service provider and, where appropriate, the police or national authorities.
Step by step
- Read the ransomware scenario.
- Write the isolation steps.
- Identify who to report to.
- Plan recovery from backup.
Practice activity
Write the ransomware section of your incident plan.
Expected result: Clear isolation, reporting and recovery steps.
Check your understanding
-
What is the first step with a ransomware-infected computer?
Show answer
Disconnect it from the network.
-
What is the real defence against ransomware?
Show answer
Tested offline backups.
Taught live by an instructor — online or in person. Free course lessons are for self-study and do not lead to a certificate — see registration options.