Ransomware has encrypted your files

Ransomware encrypts every file it can reach on your computers and servers, then leaves a note demanding payment to unlock them. The files have a new extension and won't open, and the note sits as a text file in each folder or replaces the desktop wallpaper. What you do in the first hour decides how much you get back.

Work through the steps in order and leave everything else until help arrives.

1. Disconnect from the network

Unplug the network cable and turn off Wi-Fi on every machine that's affected. If you can't tell which ones are, switch off the router and the switches. The encryption spreads between machines on the office network, so cutting the internet connection alone isn't enough.

Close VPN connections too, and shut down remote access tools such as TeamViewer and AnyDesk, so the attacker can't get back in while you work.

2. Unplug your backups

If a USB drive is plugged into a machine, or you have a NAS on the network, disconnect it now. Attackers look for backups before they start encrypting, and a drive that's still connected gets encrypted along with everything else.

3. Leave the machines on

Don't shut down or restart anything. The memory and logs on a running machine can show how the attacker got in. The exception is a machine where you can see files still being encrypted and you can't get it off the network. Switching that one off is better than losing more files.

4. Take photos and note the time

Photograph the ransom note, the screen and a folder showing the new file extensions. Use your phone, not the affected machines.

Write down when the attack was discovered. If the encrypted files hold personal data, the GDPR gives you 72 hours from that moment to report the breach to Datatilsynet, the Norwegian data protection authority. From now on, keep a log of what is done, when and by whom. Your insurer, the police and Datatilsynet will all ask for it.

5. Call your IT provider

Phone rather than email, because the attacker may be able to read your mailbox. If you don't have an IT provider, or can't reach them, you can call us on +47 40 10 10 30. We help businesses lock attackers out, recover their data and rebuild their systems.

6. Hold off on restoring

If you have backups that weren't hit, it's tempting to restore them straight away. Wait until the attacker is locked out and you know how they got in. Attackers often sit in a network for weeks before they encrypt anything. If they're still there, they'll encrypt the restored files again, and the backup with them. Restoring also overwrites the traces that show how the attack happened.

The same goes for OneDrive and SharePoint. Both can roll all your files back to how they were at any point in the last 30 days. Check that the option is there, but don't use it until the machines that sync the files are clean, or the files will be encrypted again.

7. Delete nothing and don't reply

Leave the encrypted files and the ransom note where they are. Police have taken over ransomware gangs' servers several times and released the decryption keys, sometimes months after the attack. No More Ransom, run by Europol, national police forces and security companies, has free decryption tools for many strains.

Don't reply to the note or open its links. NSM, Norway's national security authority, and the police advise against paying. Paying doesn't guarantee your files get unlocked, and data the attacker has stolen may be published anyway.

8. Report it

Call your insurer early. Many business policies cover cyberattacks, and the insurer may require you to use its own incident response firms.

If the encrypted files hold personal data, report the breach to Datatilsynet within 72 hours. Attackers usually copy data before they encrypt it, so you may also have to tell the people it concerns.

Report the attack to the police. In Mørketallsundersøkelsen 2026, a survey of 2,500 Norwegian organisations, 452 had an incident in the past year and only 57 of them reported it. The police only see the cases that get reported.

If your business falls under the Digital Security Act or the Security Act, you're required to report the attack. That mainly covers providers of essential services such as energy, transport, health and banking. Other businesses don't have to report to NSM, but can call its 24-hour line on 02497.

9. List where copies might exist

While you wait for help, write down where your data might exist outside the affected machines:

• email in Microsoft 365 or Google Workspace, which usually isn't encrypted
• accounts and invoices held by your accountant or in cloud accounting services such as Tripletex and Fiken
• old laptops, memory sticks and drives in a drawer
• attachments you've sent to customers and suppliers

Don't connect any of these to the affected machines or the network until it's clean.

Without a backup, the files are probably gone

Ransomware uses encryption that can't be broken. Without the key, neither your IT provider, the police nor a data recovery firm can unlock the files, unless a free decryption tool exists for that particular strain. Only a minority of strains have one, usually the older ones.

If you have no backup, assume that anything that only lived on the affected machines is lost. What you can get back is what exists elsewhere: email, cloud services, older versions in OneDrive or SharePoint, and copies other people hold. Some strains encrypt only parts of large files to work faster, so parts of databases and virtual machines can sometimes be recovered.

Paying doesn't change this much. The key the attacker sells doesn't always work, and decrypting with it is often slow and can corrupt files along the way.

What your IT provider does next

When your IT provider, or we, take over the case, the work usually runs in this order:

1. Work out which machines, servers and accounts are affected, whether the encryption is still running, and which strain it is. The strain decides whether a decryption tool exists.
2. Lock the attacker out: disable the accounts they've used, change the passwords on admin and service accounts, and remove the remote access tools they've installed.
3. Secure the logs from the firewall, the VPN and Microsoft 365 before they're overwritten, and copy the disks of the most important machines. Your insurer and the police need them, and they hold the answer to how the attacker got in.
4. Find the way in. It's often a VPN or remote desktop without two-factor authentication, a firewall that hasn't been patched, or a leaked password.
5. Go through the backups and check that they're complete and were taken before the attacker got in.
6. Rebuild the systems rather than cleaning them. A machine the attacker has controlled can hide backdoors that are hard to find, so the machines are reinstalled and the data goes back only once the way in is closed.
7. Watch the network for the next few weeks, because attackers often try to come back.
8. Write a report on what happened, which you can give to your insurer, Datatilsynet and the police.

What happened in Lørenskog

Lørenskog, a municipality just outside Oslo, was hit in spring 2026. On 7 April an employee downloaded a file containing malware from a website that looked genuine. The attackers reached the municipality's servers on 22 April, spent time mapping the network and struck on 8 May. The next day the municipality discovered the attack, found a ransom note and shut down all its networks and servers (Lørenskog municipality, in Norwegian).

The attackers never reached the backups, and the municipality chose not to negotiate. They had already copied large amounts of data, including child welfare cases, health and care records, school and kindergarten files and employee records. For about two months the municipality believed no sensitive personal data had been taken. On 6 July the attackers posted a list of file names on the dark web, and large amounts of sensitive data on thousands of children and adults ended up there (NRK, in Norwegian).

A review by Deloitte found that the IT systems raised three waves of alerts between 13 April and 8 May that nobody followed up, because it was unclear who was responsible. It took 26 days from the first alert to the first action. The chief executive has proposed spending NOK 34.5 million on IT in the 2027 budget, directly linked to handling the attack (NRK, in Norwegian).

The backups were untouched, but they didn't stop the data from leaking. That's why you have to report to Datatilsynet and tell the people affected, even once everything is restored.

After the attack

A backup that saves you next time needs at least one copy that sits off the network or can't be deleted. Someone also needs to have restored files from it to check that it works. That's the kind of backup we set up and test for businesses.