Ransomware locked my files: the first 48 hours and the people

What the first hours look like for people who lived through it

A ransomware attack on a home computer or small office rarely announces itself loudly. Files will not open. A message appears, often with a countdown. Photos, tax records, customer lists and years of email sit behind a lock, and a stranger tells you how to pay to get them back.

In 2025 the UK Home Office published an Ipsos study based on 39 in-depth interviews with ransomware victims: businesses, charities, public bodies and individuals. For most it was their first brush with cyber crime. Individuals first tried to understand what was happening and searched for what ransomware was. Those with little technical knowledge switched the device off and on and deleted suspicious files. Those with an IT background checked backups and tried to reverse the encryption.

What followed depended mostly on backups. Few of the individuals had backups good enough to restore everything. One said: "I didn't have any data backup. That's the problem." Another lost the photographs of a wedding and of a daughter's childhood, and said it hit their mental health: "I remember for a good couple of weeks I was very tearful a lot about it." Years on, one person was still checking websites every month, hoping someone had published a way to unlock the files.

No individual in that study paid a ransom. Three organisations did, each with no unencrypted backup and a business or charity that might not survive without its data. The report mentions amounts of around £1,000 and around £8,000, paid in Bitcoin after negotiating the first demand down.

A 2024 study by the Royal United Services Institute (RUSI), the London security think tank, partly funded by the UK's National Cyber Security Centre, rests on 42 interviews with victims and with insurers, police, government staff and incident responders. It found that for a small business owner or sole trader there is little line between the company and the person. Researcher Pia Hüsch told The Record: "If you run your own business for 20 years, that is your personality, that is your only source of income." One interviewee said, "we all blame ourselves." These were people hit by a criminal operation who then had to decide things on little sleep.

How a ransomware attack works

The NCSC describes three stages. Attackers first get into a device or network, take control and plant software that can encrypt files, and may copy your data. Then the software is switched on and the files are locked. Finally a message arrives, usually pointing to an anonymous web page where payment is demanded, normally in a cryptocurrency such as Bitcoin. The NCSC adds that attackers may threaten to publish the data they took.

The Home Office study found the way in was usually plain: open portals, servers without updates, or phishing. Individuals described a compromised website, a phishing pop-up, or a family member clicking a malicious advert.

Ransom notes varied from polished to badly written. A small share threatened to leak data, and some set a deadline from 24 hours to 7 days. A deadline is designed to rush you. Victims were often told by insurers, lawyers or Action Fraud not to engage with the attackers, and many feared that engaging would lead to repeated attacks.

One fact helps set expectations. In the Home Office study the shortest ransomware experiences lasted two to five days, and those were mostly individuals and smaller organisations. The first 48 hours are the start of recovery, not all of it.

Before any of the technical steps, the first job is a smaller and harder one: slowing your own breathing and pulse, because the first hours of an attack are when frightened people make rushed decisions, and knowing how to calm down in those hours is part of the response, not a luxury.

What an attack does to the mind

The Home Office report names stress as the most common psychological effect, with guilt next. Stress could peak during the attack and last long afterwards. IT staff and managers described heavy loss of sleep and appetite and, in one case, weight loss. One individual said the anxiety afterwards disturbed their sleep, with constant worry about their data being shared.

RUSI's interviewees used strong words. One described "a terror about what might happen next." Another said, after it was over, "there was a bit of a PTSD about every time I walked through the office door," which RUSI notes was meant in the everyday sense, not as a diagnosis. Someone in education feared bringing systems back too fast in case the criminals were still inside.

The effects reached the body and the home. RUSI reports employees falling asleep at work, and one victim saying "the fatigue on people was extreme." In one team, people who drank too much coffee and too little water needed hospital checks because of heart complications they already had. An engineering company hired a team to give post-traumatic stress support to its staff.

The most serious finding needs the most care. According to The Record, Hüsch recalled a "particularly striking interview" with someone who felt suicidal as a result of a ransomware attack. She said it was not a one-off among the interviews, though it remains relatively rare. RUSI also reports a victim who found the attack "actually really traumatic" and said it had brought them close to suicide. Such thoughts never come from one event alone and are not weakness. They are a signal to talk to someone, and the last section lists where.

There is another side. The Home Office report says not every individual described feeling recovered, which means some did, and several said backups let them rebuild within two or three days. RUSI found that reputational damage was often smaller than victims feared: one firm said "clients were quite sympathetic." Another victim said, "we very rarely talk about the mental health impact of these events." Saying it out loud to someone is a sensible place to start.

Hour zero: stop it spreading and write things down

These steps are for a Windows PC at home or in a small office. Do them in this order.

1. Disconnect. Unplug the network cable and turn off Wi-Fi from the network icon in the taskbar. CISA's checklist says to isolate affected systems at once, by unplugging them or removing them from Wi-Fi. Unplug USB drives and external backup disks too, because connected backups can be encrypted.
2. Do not delete files and do not keep restarting. CISA advises powering down only if you cannot disconnect, and notes that shutting down loses evidence held in memory.
3. Photograph the ransom note with your phone. Write down the date and time you noticed, any email or web address in the note, and the odd file extension on your documents. You need these to identify the strain and to report.
4. Do not reply and do not pay in the first hours. The NCSC and UK law enforcement do not endorse paying, and warn that you may not get your data back, your computer will still be infected, you will be paying criminals and you are more likely to be targeted again. If a business hangs on one set of files with no backup, that choice is hard, but it belongs to day two or three and to advisers.
5. From a clean device such as your phone, change the passwords for email, bank and cloud accounts and turn on two-step sign-in. CISA notes breaches often involve stolen credentials, and email accounts can be involved.

If you are too shaken, ask someone to read the steps out and tick them off with you.

Hours 6 to 24: find out what you are dealing with

Ransomware is hundreds of families, and the next step depends on which one you have.

On your phone or a clean computer, open nomoreransom.org. It hosts a free repository of keys and tools that can decrypt files locked by some ransomware. Its front page says not every type has a solution yet, that new keys are added when available, and that you should never pay. At the time of writing it listed decryptors for families including Phobos and 8base, LockBit 3.0, Akira, Rhysida and Black Basta, and its Crypto Sheriff page helps match your note to a tool.

ID Ransomware (id-ransomware.malwarehunterteam.com) takes the ransom note and one sample encrypted file and names the family it matches, out of 1,188 it detects. It decrypts nothing. Its FAQ says uploads with no match may be shared with trusted malware analysts, so choose a sample with nothing private in it, such as a photo of a pot plant, not a bank statement.

If no decryptor exists yet, keep a copy of the encrypted files on a disk. New keys appear as researchers find flaws, and one person in the Home Office study kept checking for years.

Getting files back without paying

Before you assume everything is gone, look for older copies. Check these from a clean device, or from the infected PC only after the clean-up in the next section.

Where to look	How to open it	What it needs
OneDrive version history	Sign in at onedrive.com, right-click the file, choose Version history, pick an older version and select Restore. With the OneDrive app, do the same in File Explorer.	File was saved to OneDrive before the attack
Restore your OneDrive	On the OneDrive website choose Restore your OneDrive and pick a date such as Yesterday.	Microsoft 365 subscription, up to 30 days back. After detected ransomware a suggested date is filled in, and a non-subscriber's first recovery is free
OneDrive recycle bin	OneDrive website, Recycle bin, select and restore.	Deleted files kept 30 days (personal) or 93 days (work or school)
Previous versions	In File Explorer right-click the folder, choose Restore previous versions, pick a version from before the attack.	Earlier versions were saved before the attack
File History	Use the File History interface to browse and restore earlier versions.	It was on before the attack and its drive was not affected
Disconnected backup disk	Connect it only after the PC is clean, and copy files out, never in.	It was unplugged when the attack ran

If an item is missing from the right-click menu on Windows 11, look under Show more options. Microsoft warns that files permanently deleted from the OneDrive recycle bin can never be recovered, and that a restore sends files created after your chosen date to the recycle bin, so note the date you pick.

One more thing about failed backups. In the Home Office study an owner believed an IT company backed up everything and found during the attack that some vital files were missing. Another business had stopped paying for the server holding its backups and lost years of data. This is a common gap, not proof of carelessness.

Cleaning the PC and putting things back

Restoring files onto an infected machine only gives the malware fresh files to lock. Clean first.

1. Open Windows Security from the Start menu, go to Virus & threat protection, then Scan options, and choose Microsoft Defender Antivirus (offline scan). Microsoft says this restarts the PC and scans before Windows loads, so persistent malware has a harder time hiding. Save anything open first. Results appear in Windows Security under Protection history.
2. Treat a clean result as good news, not proof. For a home PC the safest choice is to reinstall Windows from scratch (Reset this PC, or a clean install) once you have set aside a copy of the encrypted files for a future decryptor.
3. Install Windows updates, then change your passwords again from the cleaned machine.
4. Only now reconnect the backup disk. Restore a few files first and open them to check they work.
5. If you run a business, tell staff and customers in plain words what you know. The NCSC notes that clear information reduces uncertainty and stress.

If the note says data was copied, the picture changes. In the UK a business with a personal data breach must inform the Information Commissioner's Office, and the NCSC and ICO have said they worry victims hide incidents. Tell your insurer early and consider an NCSC-assured incident response provider.

Reporting it, even if your files came back

Many people skip this. The Home Office report says only around one in 15 computer misuse incidents against individuals reach the police or Action Fraud, and some interviewees saw no point once their files were back. A report will not rebuild your PC, but the report data helps law enforcement and government respond.

• United States: file a complaint at ic3.gov, run by the FBI. The IC3 warns that scammers impersonate it and that it never contacts you for money, so ignore anyone who says they can recover funds through it. CISA also takes ransomware reports at cisa.gov/stopransomware/report-ransomware-0.
• United Kingdom: report through Action Fraud, now Report Fraud, at reportfraud.police.uk (the old actionfraud.police.uk address leads there). If a business or charity is under attack right now, call 0300 123 2040. In Scotland, report through 101. Organisations can also report to the NCSC at gov.uk/report-cyber.
• If someone is in immediate danger, call 911 (US) or 999 (UK). If a child is involved, the IC3 says reports about crimes against children go to the National Center for Missing and Exploited Children.

Looking after yourself and your staff in the days after

The first 48 hours are physical. People forget to eat, drink and sleep. Set simple rules: eat at fixed times, drink water, and agree who covers which hours.

The NCSC has welfare guidance for managers: include everyone in the plan, build a culture where people can say they are overwhelmed, plan internal messages, be open about worries such as lost personal data or jobs, and practise before you need to. Stress leads to mistakes and burnout, so caring for people is also a security measure.

For a small team, say what has happened, what you know and do not know, and when you will update again. Thank the person who spotted the problem and do not hunt for someone to blame. RUSI found IT staff often blame themselves and burn out.

In the following weeks watch for the aftershocks: fear at every suspicious email, poor sleep, avoiding online banking or the computer itself. One person in the Home Office study felt scared to be on the computer afterwards. These reactions are common. If they do not ease, ask a doctor, counsellor or employer support line. In the UK the Report Fraud site lists support organisations such as Victim Support.

Protecting the next backup

The NCSC and CISA both say to keep a recent offline copy of what matters most. In the Home Office study, organisations with regular automatic backups held offline, in separate services or in restricted cloud storage lost very little. One lost only two hours of email. Permanent loss was extensive where backups had been encrypted too or were out of date.

• Keep one copy of important files on an external disk that stays unplugged except when you back up, and test a restore regularly.
• Keep a second copy in cloud storage that keeps older versions, such as OneDrive version history.
• Turn on Controlled folder access. In Windows Security go to Virus & threat protection, under Virus & threat protection settings choose Manage settings, then Manage controlled folder access, and switch it On. Select Yes on the User Account Control prompt. Microsoft says it blocks untrusted apps from changing files in protected folders. If a program you trust is blocked, use Allow an app through Controlled folder access, then Add an allowed app and pick it from Recently blocked apps.
• Do not leave remote desktop or similar services open to the internet; CISA advises against it. Keep Windows and your browser updated, and use two-step sign-in on email and cloud accounts.
• For a business, keep a one-page plan with phone numbers for your IT supplier, insurer and a decision-maker, and a paper copy.

If you need to talk to someone now

If you are thinking about harming yourself, or the shame and fear after an attack feel unbearable, you do not have to carry this alone, and it does not matter how much money was lost or how it happened.

• In the United States, call or text 988 to reach the 988 Suicide & Crisis Lifeline, any time.
• In the UK and Ireland, call Samaritans free on 116 123, any time.
• Anywhere else, call your local emergency number or go to the nearest emergency department. If you are with someone who is in danger, stay with them.

A locked file is a problem with steps. You are not the problem.

Frequently asked questions

Ransomware attack: what should I do first?

Disconnect the device from the network by unplugging the cable and turning off Wi-Fi, unplug any external drives, and photograph the ransom note. Do not delete files, do not pay, and do not reply. Then identify the ransomware family from a clean device and look for backups. CISA's ransomware checklist begins with isolating affected systems.

Ransomware what to do: should I turn the computer off?

CISA advises powering a device down only if you cannot disconnect it from the network, because shutting down removes evidence held in memory. If you can unplug the network cable or switch Wi-Fi off, do that first and leave the screen as it is until you have photographed the note.

Should I pay the ransom?

The NCSC and UK law enforcement do not encourage or endorse paying. Paying gives no guarantee you will get data back, your computer stays infected, you fund criminals, and you may be targeted again. In the Home Office study no individuals paid, and only three organisations did, all with no usable backup.

Can I get my files back after files are encrypted by ransomware?

Sometimes. Check the No More Ransom project for a free decryptor for your family, and look for older copies in OneDrive version history, Previous versions, File History or a disconnected backup disk. Keep a copy of the encrypted files, because new decryption keys are added over time.

How do I remove ransomware from Windows?

Disconnect first, then run a Microsoft Defender offline scan from Windows Security under Virus & threat protection, Scan options. The scan restarts the PC and runs before Windows loads. For a stronger result, reinstall Windows from scratch after saving a copy of the encrypted files, update everything, and change your passwords.

Can OneDrive restore my files after ransomware?

If your files were synced to OneDrive, you can often restore earlier versions. Microsoft 365 subscribers can restore their whole OneDrive to a point in the last 30 days, and Microsoft sends a notification when it detects ransomware, with the first recovery free for non-subscribers. Files permanently deleted from the recycle bin cannot be recovered.

Is it normal to feel panicked, guilty or ashamed after a ransomware attack?

Yes. The Home Office study named stress and guilt as the most common reactions, and one interviewee told RUSI 'we all blame ourselves.' Sleep loss, panic and fear of the next email are also common. If the feelings are heavy or last, talk to a doctor or counsellor, and call 988 (US) or Samaritans on 116 123 (UK and Ireland) if you are thinking of harming yourself.