Follow this checklist in order: identify what happened, stop further damage, save evidence, secure email and money, recover accounts safely, then protect against further activity.
Use a device you trust, pause suspicious contact and protect your main email and any money at risk first. Save evidence, then follow a calm recovery order for accounts, devices and follow-up protection. Do not rush to wipe a device or reset every password.
Prepared and reviewed by IT Life-Raft
UK-based IT support and cyber recovery guidance. Last reviewed 6 November 2026.
Before changing passwords or resetting devices, work out what looks affected. This helps you choose the safest recovery path and avoid destroying useful evidence.
Paying does not guarantee your files will be recovered or stolen data deleted. Disconnect affected devices from the network, keep the ransom note and contact your IT support or incident-response provider from a trusted device. Check safe backups and report the attack before taking recovery action.
If you need to recover an account, use the provider’s own recovery page. Never give a password, security code or payment to someone who contacts you first.
Use these links after checking the affected account and device. If money or personal data may be at risk, contact your bank or the appropriate reporting service as well.
Personal email, bank, phone, computer, Microsoft, Google, Apple, shopping or social accounts.
Secure the main email or logon account from a clean, trusted device. Check that the password, recovery details and sign-in methods belong to you.
Run trusted security scans, remove unfamiliar extensions or apps, and update Windows, browsers, phones, tablets and key apps.
Review sign-ins, password resets and security changes. Record dates, times, alerts and anything suspicious you remove.
Look in Inbox, Sent, Deleted Items, Junk and unfamiliar folders. Check for rules that move, delete, redirect or forward messages.
Delete unfamiliar rules, forwarding addresses, delegates, connected apps or recovery details. Test that a normal email arrives as expected.
Review cloud storage, sharing links, deleted files, recycle bins and version history before restoring anything.
Change passwords on banking, shopping, social, cloud and other accounts that use the same or a similar password. Use a different strong password for each one.
Tell people who may have received a suspicious email, message or password-reset notice from you. Ask them not to act on payment requests or links.
Review payments, orders, refunds and saved payment details. Contact your bank if money is involved, and be cautious of fake recovery services or urgent support calls.
Work email, Microsoft 365, Google Workspace, staff devices, websites, customer data or shared systems.
Contact your IT support with a Priority 1 (P1) ticket. Check cyber-insurance notification requirements before taking major recovery actions.
Follow your data protection, incident response, backup and acceptable-use policies. Tell finance, data protection or senior decision makers where appropriate.
Save logs, screenshots, emails, alerts, affected users, timelines and actions taken. Use a trusted phone number or alternative channel if email may not be safe.
Reset passwords, revoke active sessions, review authentication methods and remove unfamiliar recovery details with IT support.
Review unusual sign-ins, administrator roles, group membership and changes. Check whether other staff accounts show similar activity.
Work out which systems, accounts, devices, users and data may be affected. Assess whether customer, staff or supplier personal data could be involved.
Review inbox rules, forwarding, delegates, Sent Items, Deleted Items and suspicious messages. Check whether invoice, payment or supplier emails were redirected or changed.
Review Teams, SharePoint, OneDrive and connected applications. Check for unfamiliar app permissions, sharing links, downloads or changes to company data.
Check that backups are available and record whether a restore can be completed safely. Avoid overwriting clean recovery points while the investigation is under way.
Pause changes to supplier bank details and confirm payment instructions using a known phone number. Warn staff, customers or suppliers if messages may have been sent from the account.
Use these PDFs to record the information you may need before something goes wrong, then follow the same staged recovery process used on this page.
For personal email, phones, computers, banking, shopping, social media, Microsoft, Google and Apple accounts.
Download Home User PDFFor Microsoft 365, Google Workspace, staff accounts, websites, shared systems, customer data and incident records.
Download Business PDFHelp assessing, securing and recovering business systems.
Fraud, scams and cyber crime reports in England, Wales and Northern Ireland.
UK government-backed scheme that helps organisations protect against common cyber attacks.
Check whether an email address or password has appeared in known data breaches.
Personal data breach guidance and reporting for UK organisations.
Free offline password manager for keeping unique passwords in an encrypted database.
Microsoft security guidance and built-in Windows protection tools.
Serious organised cyber crime information. Call 999 in an emergency or 101 for non-emergency police support.
UK National Cyber Security Centre advice for individuals, families and small organisations.
Free second-opinion malware scanner for Windows devices where a trusted scan is appropriate.
If money, customer data, Microsoft 365, a website, domain name or several devices are involved, get practical help before deleting evidence or rebuilding systems.
This guide gives general information only. It does not guarantee recovery of accounts, files, data or money. Every incident is different.