What to do in the event of a ransomware attack

4.) Identify

Different strains of ransomware use different methods to encrypt your data, so if you want to be able to decrypt it then it’s important to identify exactly what you have fallen victim to.

There are a number of free online services which can identify the ransomware for you after you to upload an encrypted file or the ransom note. These include ID Ransomware and Crypto Sheriff. Alternatively, if you have access to another computer, you can download a free identification tool such as the Bitdefender Ransomware Recognition Tool

5.) Remove

Before making any attempts to retrieve your data, it is vital that you remove the ransomware infection from your computer. If you don’t, the ransomware will simply re-encrypt any data you recover and you will be back in the same situation as before. Most good endpoint protection products from vendors such as Avast, Bitdefender, or Norton should be able to do this.

6.) Search for deletions

Some strains of ransomware copy data, encrypt the copies, and then delete the original data. If that’s the case then it may be possible to recover some of your data using a tool such as ShadowExplorer or Recuva.

7.) Decrypt

Modern encryption techniques, when properly implemented, result in encrypted files which are effectively impossible to decrypt without the encryption key which only the ransomware author possesses. (It may be possible to guess the encryption key, but a fast computer making millions of guesses per second could take thousands of years to chance upon the correct key).

The good news is that in some cases the ransomware authors have not implemented the encryption correctly, or the decryption keys (or ways to generate them) have leaked out into the public domain. That means that if you have fallen victim to one of these strains of ransomware then it is possible to decrypt your files and restore access to your data. To make this easy many security researchers have created decryption tools.

To decrypt your data, head to a decryption tool repository such as NoMoreRansom or Heimdal Security’s decryption tool directory. If the strain of ransomware you identified in step 4 above is listed then download the decryption tool, and then follow the instructions to decrypt your data.

8.) Restore

If no decryption tool exists for the ransomware that has encrypted your files, then the next course of action is to delete the encrypted data files (or better still store them somewhere offline in case a decryption tool becomes available at a later date) and restore it from a backup.

This, of course, presupposes that an up-to-date backup of your data exists, and the backup has not also been encrypted or infected by the ransomware. Backups are more likely to be out of date or encrypted if they are carried out manually (perhaps every evening) and stored on a second hard drive or a connected external drive than they are if they are carried out automatically to a backup storage service in the cloud such as Livedrive or Carbonite.

To ensure that no trace of the ransomware remains on your computer, some security experts recommend completely wiping your hard drive and reinstalling the operating system and all applications before restoring your data.

9.) Last resort measure

If no decryption tool exists and restoring data from a backup is not possible (or the data is too far out of date to be useful) then the final option is to consider paying the ransom.

There are a number of important things to consider carefully:

• Law enforcement agencies discourage the payment of ransoms to ransomware authors because it encourages hackers to launch ransomware attacks and funds criminal activities
  
  
• Paying a ransom does not guarantee that you will get your data back. It is believed that between 5% and 40% of organisations that pay a ransom get nothing in return
  
  
• If your charity faces an existential threat due to the loss of data, or if the cost of disruption due to the loss of data is very high, then paying a ransom of a few hundred or thousand pounds for a 60% - 95% chance of getting the data back may be a sensible business decision and in the best interests of those your charity seeks to help
  
  
• 70% of businesses that are hit by ransomware pay the ransom, according to a 2016 IBM survey
  
  
• Organisations that pay a ransom and receive a decryption tool still lose 7% of their data on average, according to Coveware
  
  
• Using charity funds to pay a ransom to cyber criminals may generate extremely bad publicity for your charity
  
  
• Paying a ransom may mark your charity out as a "payer", thus encouraging further ransomware attacks