PanicStation.org
UK USA
uk Technology & digital loss files renamed suddenly • file extensions changed • strange file extensions • files look encrypted • folders renamed • random file names • files have .locked extension • files have .encrypted extension • ransom note on computer • possible ransomware • possible malware infection • cloud sync went wrong • shared drive files changed • external drive affected • photos documents unreadable • can't open my files • windows files changed names • mac files changed extensions • happened all at once • i don't know what changed them

What to do if…
your files suddenly change names or extensions and you do not know why

Short answer

Treat this as a possible ransomware/malware incident until proven otherwise: disconnect the affected device from the internet and any shared drives immediately, then pause any cloud sync before you do anything else.

Do not do these things

  • Don’t keep “trying fixes” (renaming files back, running random cleanup tools, restoring things repeatedly) while the device is still online.
  • Don’t plug in more USB drives “to back up quickly” until you’ve isolated the device (malware can spread to newly attached drives).
  • Don’t pay a ransom or respond to any ransom message in a rush.
  • Don’t wipe/reinstall straight away if you may need evidence for support, insurance, work IT, or reporting.
  • Don’t assume it’s “just a setting” if lots of files changed at once or you see a ransom note.

What to do now

  1. Isolate the device (containment first).
    • Turn off Wi-Fi and Bluetooth, unplug Ethernet, and disconnect from mobile hotspot.
    • If it’s on a home/work network with shared storage, consider turning off Wi-Fi at the router briefly to stop spread.
  2. Stop sync and sharing immediately (to prevent propagation).
    • Pause cloud sync on the affected device (e.g., OneDrive/iCloud/Dropbox).
    • If you can do so safely, also pause sync from the provider’s web dashboard using another, known-clean device.
    • Disconnect external drives and unplug network-attached storage (NAS) if you suspect it’s being affected.
  3. Document what you see (before it changes).
    • Take photos/screenshots of: file extensions, error messages, ransom notes, and the time/date you noticed it.
    • Write down which folders/drives are affected (e.g., “Documents and Photos, but not Downloads”).
  4. Check whether other devices are being hit (without reconnecting the suspect device).
    • From a different, known-clean device, check whether the same folders in the cloud or on shared storage show the same renamed/encrypted files.
    • If other devices look affected, isolate them too.
  5. Use the right reporting/support route quickly.
    • If this is a work/school device: contact your IT/helpdesk immediately and say “possible ransomware/encryption and file renaming”.
    • If you’re an individual in the UK: report cyber crime/fraud via Report Fraud (the national reporting service; the older “Action Fraud” site name may redirect).
    • If you live in Scotland, reporting is typically via Police Scotland (101) for non-emergency.
  6. Preserve a small “sample” safely (only after isolation).
    • If you can do it while staying offline: copy a small set of changed files plus any ransom note text to a separate USB drive (ideally empty/newly formatted), then unplug it and label it (date/time).
    • Don’t reconnect that USB drive to other computers unless a trusted professional/IT advises you to.
  7. If changes keep happening after you’ve disconnected networks.
    • If file names/extensions continue changing even while offline, shut the device down to stop further damage, then hand over to IT or a reputable local computer security professional.

What can wait

  • You do not need to decide today whether to wipe the device, pay anything, or tell everyone you know.
  • You do not need to identify the exact malware strain right now.
  • You do not need to attempt full recovery immediately; the priority is stopping spread and preserving what’s there.

Important reassurance

When lots of files suddenly change names/extensions, it’s normal to feel panicked and start clicking. Pausing and isolating the device first is the safest move and often prevents the situation from getting much worse.

Scope note

This is first-steps-only guidance to contain damage and avoid irreversible mistakes. Recovery (restoring from backups, rebuilding devices, dealing with accounts) often needs careful, situation-specific support.

Important note

This is general information, not professional forensic or legal advice. If you’re unsure whether this is ransomware, acting as if it is (isolating, pausing sync, documenting) is usually the least-regret first step.

Additional Resources
Support us