I have been infected with ransomware. Now what?

I have been infected with ransomware. Now what?

In recent years, ransomware infections have increasingly affected companies of all sizes — as well as individuals — leaving them without access to their information.

1. Isolation

As soon as ransomware is detected, isolate the affected computers immediately by disconnecting them from the network. This prevents the infection from spreading.

2. Report the incident

Notify the authorities as soon as possible:

• Civil Guard – Telematic Crimes Group
• National Police – Central Technological Investigation Brigade (BCIT)

3. Get help

The INCIBE (National Institute of Cybersecurity) provides a cybersecurity helpline at 017 for citizens and organizations. They will guide you through the steps to follow.

4. Recovery

With help from law enforcement, INCIBE, or a specialized cybersecurity company, try to recover the encrypted information:

• In some cases, decryption is possible if the encryption used can be broken.
• If not, recovery will depend on having valid backups available.

5. Pay or not pay?

From a legal and ethical standpoint, never pay the ransom. Paying finances and encourages criminal activity.

Prevention: the best defense

• Keep antivirus software up to date on all systems and networks.
• Ensure equipment and programs are patched and updated regularly.
• Use secure system configurations.
• Raise employee awareness — most infections occur through phishing. Employees must:
  • Recognize suspicious messages.
  • Understand different attack methods.
  • Know how to defend against them.
• Maintain regular backups of all critical information to ensure operational continuity and enable system restoration after an attack.