Skip to main content

Step 5: Get professional help

Icon of a person wearing a headset

Asking for help early could avoid further harm

Who you ask for help may depend on what systems or files the ransomware has infected.

  • To find an IT professional in your area, search online (using a non-infected device).
  • Ask a colleague, friend or family member if they have seen this type of issue before. They might know the details of a professional that can help you.
  • If you are the victim of identity theft, visit IDCARE or call 1800 595 160. It is a free not-for-profit service to help you.
  • If you have cyber insurance, contact your insurance provider. Be prepared to answer questions about Step 4: Write down key details.
  • If the ransomware targeted your software, applications, or accounts, consider contacting the provider. For example, Facebook, Gmail, or MYOB.
  • Report a cybercrime or cyber security incident online on the ACSC report a cybercrime page.

Working with a professional

When you find a professional, make sure you follow these tips.

1. Give them all the details you have:

  • When you find a professional, give them the details you wrote down in Step 4. Tell them your data is encrypted with ransomware.

2. Backup your data:

  • If you have an existing backup of your files, let the professional know. 
  • Ask the professional to create a backup of your encrypted files onto a separate, blank storage device. Make sure this step is done, even if your files are still encrypted. A decryption tool may be available now or in the future that will unlock your files. We have advice on backing up and restoring data.

3. Remove the ransomware:

  • Ask the provider to confirm that the ransomware is gone from your device. Note: this step may involve a factory reset, which is irreversible. Talk to the professional about potential data loss before doing this step.

4. Reconnect your device and update: 

  • Ask the provider to reconnect the unaffected device to your network. Once reconnected to the internet, your provider can update your operating system and software. 

5. Restore from an unaffected backup:

  • If you had an unaffected, recent backup, this step will restore your files to their previous state. Work with the professional to restore your files from backup. You will not be able to do this step if your recent backup is infected with ransomware. We have advice on backing up and restoring data.

6. Decrypt your files:

  • For some versions of ransomware, decryption tools may become available. You can use these to unlock your files. Ask a professional to look for a decryption tool that could work for your files.
  • We recommend No More Ransom. It is a free and reputable online resource. Law enforcement agencies and security companies manage it. If there is no decryption tool currently available that works for your files, there may be one in the future.
Was this information helpful?
Was this information helpful?

Thanks for your feedback!


Tell us why this information was helpful and we’ll work on making more pages like it