# Responding to Ransomware

# Responding to Ransomware

*Adapted from GitLab's "Responding to Ransomware".*

Ransomware encrypts files and demands payment. It can arrive through a phishing attachment, a compromised account, or an exposed device or server. **NFE's position: we restore from backups rather than pay a ransom.**

## First steps

1. **Disconnect the affected device from the network** (Wi-Fi off, cable out). Don't switch it off: memory can hold useful evidence.
2. **Stop Nextcloud sync** on that device. Encrypted files can sync to the server and to colleagues. Pause the desktop client, or ask the Security DRI to disable the account.
3. Report as **S1** ([Reporting a Security Incident](https://bookstack.nearlyfreeenergy.com/books/security/page/reporting-a-security-incident)).
4. Don't contact the attackers and don't delete the ransom note. Take photos or screenshots.

## Recovery

- **Nextcloud** keeps file versions and a trash bin. Damaged files can usually be rolled back per file, or in bulk by an admin.
- Server-side backups are held by **Federated Computer**. Ask them for a restore point from before the infection.
- Field devices (Raspberry Pi / OpenEMS): re-image from a known-good image and re-apply configuration from version control. Never restore from the infected card.
- Reinstall the affected laptop before it rejoins the network. Change every password that was saved on it.

## Who to involve

- **Security DRI:** leads the response.
- **Federated Computer:** server backups, mail, LDAP.
- **Tech lead:** field devices and customer sites, if affected.
- **Board / directors:** for S1. They decide on external communication, including telling customers or funders if their data was involved, which may be legally required.

## Prepare now

- Check that backups exist and **test a restore** at least once a year.
- Keep operating systems and apps updated; see [Device and Network Security](https://bookstack.nearlyfreeenergy.com/books/security/page/device-and-network-security).