PanicStation.org
UK USA
uk Technology & digital loss ransom note on screen • ransomware message • files encrypted • computer locked ransomware • pop-up ransom demand • black screen ransom note • bitcoin ransom demand • crypto payment demand • decrypt key demanded • hacked and locked out • suspicious encryption • sudden file extensions changed • desktop wallpaper ransom note • network drive encrypted • work laptop ransom note • home computer ransomware • not paid yet • not contacted attacker • scared to click anything • data held hostage

What to do if…
your computer displays a ransom note but you have not paid or contacted anyone yet

Short answer

Disconnect the affected computer from the internet/network immediately, then pause and document what you’re seeing (photos/screenshots) before you do anything else. Don’t reply to the ransom message.

Do not do these things

  • Don’t pay, negotiate, or message the attacker “just to ask” — it can increase pressure and risk.
  • Don’t click links, QR codes, or “support chat” buttons on the ransom note.
  • Don’t plug in backup drives, USB sticks, or external hard drives “to copy what you can” — you may encrypt/infect them too.
  • Don’t run random “ransomware removal” tools you don’t understand — it can make recovery harder or overwrite information responders may need.
  • Don’t log into banking/email/password-manager accounts on the infected computer.
  • Don’t accept unsolicited “help” calls/messages from people who claim they can fix it if you pay them.

What to do now

  1. Isolate the device (first priority).
    • Turn off Wi-Fi and Bluetooth.
    • Unplug the Ethernet cable if there is one.
    • If it’s a work/school device, disconnect from any dock/office network too.
  2. Freeze the scene for reference.
    • Take clear photos of the ransom note, any filenames/extensions shown, the time/date, and any “ID” the note displays.
    • If you can do so without clicking around, write down which folders/drives look affected (e.g., “Documents”, “Desktop”, a shared drive letter).
  3. If it’s a work/school computer: stop and escalate.
    • Do not attempt fixes yourself. Contact your IT/helpdesk/security team using a different device/phone.
    • Tell them: “Ransom note on screen; device isolated from network; I have not paid or contacted anyone.”
  4. From a known-clean device, secure the accounts that matter most.
    Prioritise: email account(s), banking, cloud storage (Google/Microsoft/Apple), and any remote access accounts. Turn on 2-step verification if you can.
    • If you use a password manager and you’re unsure whether it’s affected, change the master password only from a known-clean device.
  5. Treat it as real ransomware until proven otherwise.
    • Some incidents are “scareware” (a lock screen) and some are real encryption. Don’t test by clicking around. Keep it isolated and move to reporting/help.
  6. Report it (even if you haven’t lost money yet).
    • If you’re in England, Wales, or Northern Ireland: report cyber crime/fraud via Report Fraud (the UK online service).
    • If you’re in Scotland: report to Police Scotland (101 for non-emergency, or their online reporting options).
    • If this involves an organisation, they can also report the incident to the NCSC via its cyber incident reporting service.
  7. If you’re worried about identity/financial exposure, add immediate friction.
    • Notify your bank’s fraud team (use the number on your bank card/app, not one in any message).
    • Watch for account takeover signals (password reset emails you didn’t request, new payees, new devices).

What can wait

  • You do not need to decide today whether you will ever pay (many people never do).
  • You do not need to try to “clean” or “decrypt” the machine right now.
  • You do not need to contact the attacker to “buy time”.
  • You can leave detailed incident write-ups and longer-term prevention steps until after the device is contained.

Important reassurance

Seeing a ransom note is designed to trigger panic and rushed decisions. You’ve already done the most protective thing by not paying or engaging — isolating the device and slowing down prevents a bad situation becoming worse.

Scope note

This is first steps only for stabilization and harm-prevention. Recovery (restoring files, rebuilding the device, dealing with backups, and checking for data theft) can require specialist help depending on what was hit.

Important note

This guide is general information, not legal or professional advice. If the device is owned by an employer/school or contains other people’s personal data, follow your organisation’s incident process and consider data protection obligations.

Additional Resources
Support us