Ransomware criminals lock up files and demand payment to decrypt them, dont pay, was the advice a consultant gave to a group at SecureWorld. When the ransom demand appears on the screen, they should disconnect the device from the network immediately and tell IS. The organization should notify the FBI, which is complicated because calling them in means relinquishing control of the investigation and perhaps devices and data they contain that are needed as evidence. He has a string of steps businesses should take as best practices against ransomware that also are good network hygiene.”]
Source: https://www.csoonline.com/article/3184216/consultant-urges-never-pay-ransomware-demands.html