Incident guide
Files encrypted or a screen demands payment
Files will not open, carry a new extension, or a note or lock screen demands payment, including screens that claim to come from the police.
Work through the steps in order. Tick a step when it is done; ticks stay in this browser. If a step does not apply to you, skip it.
Is this your situation?
- Your files will not open and have an extension you do not recognise.
- A note, wallpaper or full-screen message demands payment, often in cryptocurrency.
- A screen says it comes from the police or another authority and that you committed an offence. A demand for payment on a lock screen is a criminal's demand, whatever name it uses.
- Several computers or shared folders are affected at the same time.
Steps
First 15 minutes
The same day
The following days
Do not
- Do not pay. Paying does not ensure you get the files back and it funds the next attack.
- Do not negotiate with the sender or use the contact details on the note.
- Do not format the device or reinstall before the evidence is kept.
- Do not run “decryptor” programs from search results, adverts or messages.
Keep as evidence
- Photos of the screen and the note, including any address or identifier.
- One or two encrypted files with their names and extensions, left untouched.
- The time you first noticed, and the list of affected devices and folders.
- The message, attachment or download that may have started it.
Where to report
Anywhere
Your IT contact or provider
When: Right away, if the device is used at work or shares a network.
How: Tell them before anything is changed on the affected systems, and share your notes.
Your bank or card issuer
When: Only if you paid or card details were on the device.
How: Call the number on the back of your card or on the bank's official site, say what happened and ask for a reference number.
In Turkey
Siber Güvenlik Başkanlığı (USOM services)
When: Today.
How: Use the cyber incident report and malicious link services on siberguvenlik.gov.tr.
Police station, public prosecutor's office or the Cybercrime Branch Directorate (EGM)
When: If you want a criminal complaint or the loss is significant.
How: Apply with a signed petition handed in person; the EGM FAQ says petitions are not accepted by e-mail. For offences that depend on a complaint, the person affected has to apply. Take the evidence you kept.
Personal Data Protection Board (KVKK)
When: If you are a data controller and personal data was affected.
How: A data controller notifies the Board without delay and within 72 hours at most of learning of the breach. If it is late, the reason for the delay goes into the notification (Board Decision 2019/10).
Reading from outside Turkey: contact your national CERT or the cybercrime unit of your local police. The Turkish channels above are for people in Turkey.
Incident log
Notes stay in this browser on this device and are never sent to ZEKASTRA or anyone else. Anyone who uses this browser profile can read them, so clear the log when you are done.
Sources
This guide is general information, not legal advice. It cannot recover an account or money. Follow the instructions of your bank, your employer and the authorities.