If you’re the victim of cyber extortion, disconnect the affected devices from the internet, document everything about the attack without altering the systems, and report it to the FBI’s Internet Crime Complaint Center at ic3.gov. Act fast, keep the evidence intact, and do not pay the ransom before you’ve talked to law enforcement and, if possible, an attorney. The hours right after discovery are when you have the most ability to limit damage and the most ability to accidentally destroy the proof investigators need.
Disconnect the Affected Systems
Cut the attacker’s access first. Unplug compromised computers from the network, disconnect from Wi-Fi, and disable any remote access tools. This stops ransomware from spreading to other devices and prevents the attacker from continuing to exfiltrate data. If your organization has an IT team, bring them in immediately so they can map the scope of the breach while containment is still possible.
Do not delete files, wipe drives, reboot machines, or try to negotiate on your own at this stage. Each of those actions can destroy forensic evidence or tip off the attacker that you’ve noticed them.
Document and Preserve Everything
Before you touch anything else, take screenshots or photos of the extortion message, including any cryptocurrency wallet addresses, email addresses, or usernames the attacker provides. Write down the exact date and time you discovered the attack and which systems appear affected. Save every follow-up communication: emails, chat messages, ransom notes left on the system, and any new demands. Log when each message arrived and the platform it came through.
If you have the technical capability, create forensic images of affected hard drives so investigators have a snapshot of the drive’s full state, including deleted files and system logs. If you don’t have that expertise, leave the systems powered on in their current state for a professional to handle.
Keep a chain-of-custody record from the moment you start collecting: who collected each piece of evidence, when they collected it, how it was stored, and every time it changed hands.1National Institute of Standards and Technology. Computer Security Incident Handling Guide (SP 800-61r2) That record is what keeps evidence usable later, whether in an investigation, an insurance claim, or court.
Report the Attack
File a complaint with the FBI through the Internet Crime Complaint Center at ic3.gov. Include every detail you’ve documented: dates, attacker communications, cryptocurrency addresses, and anything identifying about the perpetrator. IC3 doesn’t respond to every individual submission, but it analyzes patterns across complaints and routes reports to FBI field offices and partner agencies, which is how many cybercrime investigations actually begin.2Internet Crime Complaint Center. Internet Crime Complaint Center Home For scale, IC3 received more than 86,000 extortion-related complaints in 2024 alone, representing over $143 million in reported losses.3Internet Crime Complaint Center. 2024 IC3 Annual Report
Organizations should also report to the Cybersecurity and Infrastructure Security Agency at cisa.gov/stopransomware. CISA provides technical assistance, shares threat intelligence, and maintains a ransomware response checklist covering containment and recovery.4Cybersecurity and Infrastructure Security Agency. StopRansomware Resources If your organization qualifies as critical infrastructure, upcoming rules under the Cyber Incident Reporting for Critical Infrastructure Act will require reporting covered cyber incidents to CISA within 72 hours and any ransom payments within 24 hours.5Cybersecurity and Infrastructure Security Agency. Cyber Incident Reporting for Critical Infrastructure Act of 2022
File a report with local police as well. It creates an official record you may need for insurance, and local detectives sometimes coordinate with federal task forces.
Do Not Pay the Ransom
The FBI’s position is unambiguous: do not pay. Paying doesn’t guarantee you’ll get your data back, it marks you as a willing payer for future attacks, and it funds the ecosystem that targets the next victim. The FBI has stated that payment “encourages perpetrators to target more victims and offers an incentive for others to get involved in this type of illegal activity.”6U.S. Department of the Treasury. Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
There’s a legal risk that catches many victims off guard. The Treasury Department’s Office of Foreign Assets Control has warned that paying a ransom to a sanctioned entity or country can violate federal sanctions law, even if you had no idea who was on the other end. Many ransomware gangs operate from sanctioned jurisdictions, so a payment made in desperation can expose you or your organization to civil penalties on top of the damage already done.6U.S. Department of the Treasury. Updated Advisory on Potential Sanctions Risks for Facilitating Ransomware Payments
Extortionists manufacture panic deliberately. Countdown timers, threats to publish within hours, impersonation of authority figures: these are pressure tactics, not real deadlines. Recognizing them for what they are is how you resist paying on impulse. Slow down, contact law enforcement, and look at your recovery options before you respond to any demand.
If You’re Being Sextorted
Sextortion, where someone threatens to distribute intimate images or personal information, is a different kind of attack and often more isolating. The FBI’s point is that if someone is extorting you this way, you are a victim of a crime, and reporting it is the right step. Contact your local FBI field office, call 1-800-CALL-FBI, or report online at tips.fbi.gov.7Federal Bureau of Investigation. Sextortion
If intimate images have already been shared without your consent, the National Center for Missing and Exploited Children runs a free tool called Take It Down at takeitdown.ncmec.org that helps remove explicit content from participating platforms. For immediate emotional support, call 988 or text THORN to 741741 to reach a trained counselor.8Office of Juvenile Justice and Delinquency Prevention. Sextortion Victim Resources
One thing to understand: these criminals typically run the same scam on many people at once from dozens of accounts. Complying with their demands almost never makes them go away. It confirms that pressure works and invites more of it.
Recovering Your Data
Before rebuilding, eliminate the attacker’s foothold. Run a thorough antivirus scan on all affected machines, disable any breached user accounts, and identify the vulnerability the attacker exploited. Skipping this step is a common mistake that leads to reinfection within days.
If ransomware encrypted your files, check the No More Ransom project at nomoreransom.org before assuming everything is lost. Backed by Europol and major security companies, the site provides free decryption tools for many ransomware families. You upload a sample of an encrypted file or the ransom note, and the site identifies whether a known decryption key exists. Remove the ransomware completely before attempting decryption, or it will simply re-encrypt your files.9The No More Ransom Project. Decryption Tools
If no decryption tool exists for your variant, restoring from clean backups is your primary path. Verify the backups weren’t themselves compromised before you restore. Once systems are back online, patch the vulnerability that allowed the initial breach, reset all credentials, and monitor closely for signs of persistent access. CISA’s StopRansomware site publishes a detailed checklist for each of these recovery steps.4Cybersecurity and Infrastructure Security Agency. StopRansomware Resources
Breach Notification and Insurance
If the attacker accessed personal information belonging to customers, employees, or anyone else, you likely have a legal duty to notify those people. All 50 states, the District of Columbia, and U.S. territories have data breach notification laws. The specifics vary: some states require notification within 30 days, others allow 60 or 90, and many require you to also notify the state attorney general. Failing to comply can bring enforcement actions on top of the extortion itself.
Get a lawyer involved. An attorney with cybersecurity and data privacy experience can determine which states’ notification laws apply (it depends on where the affected individuals live, not where your business is located), what the deadlines are, and whether you need to notify regulators. For organizations in regulated industries like healthcare or financial services, sector-specific rules such as HIPAA may add further obligations. The analysis is fact-specific enough that going it alone is genuinely risky.
If you have a cyber insurance policy, contact your insurer before making major decisions. Many policies cover forensic investigations, data recovery, business interruption losses, and notification costs. Some cover ransom payments, though insurers increasingly impose conditions on that coverage. Your policy may require you to use pre-approved forensic firms or follow specific reporting procedures, and skipping those steps can jeopardize the claim.
Hardening Against the Next Attempt
Once the immediate crisis is contained, close the gaps that let the attacker in. Federal cybersecurity agencies recommend the following practices:
- Use long, unique passwords. CISA recommends at least 16 characters mixing uppercase and lowercase letters, numbers, and symbols, with a different password for every account.10Cybersecurity and Infrastructure Security Agency. Use Strong Passwords
- Turn on multi-factor authentication for email, financial accounts, and anything with access to sensitive data.
- Keep offline backups the attacker cannot reach through your network, and test the restoration process so you know it actually works.
- Patch software promptly. Many ransomware attacks exploit known vulnerabilities that fixes already exist for.
- Train the people around you. Most cyber extortion starts with a phishing email or a social engineering call, and employees who can spot suspicious messages are the best early warning system you have.