A ransomware negotiation response checklist secures systems first, then passwords and accounts, then credit. It treats any ransom demand as a containment and recovery problem, not a payment shortcut. Ransomware is software that locks files or computers until a fee is paid. Negotiation means any contact about payment, timing, or decryption tools while you contain the incident.
Table of Contents
- Contain infected systems before anything else
- Should you pay to get files back?
- When should passwords be reset?
- How should logins be hardened after recovery?
- Do you need a freeze, alert, or credit check?
Contain infected systems before anything else
According to CISA, victims should determine which systems were affected and isolate them at once, secure backups, and preserve logs before rebuilding, as described in CISA's ransomware response checklist. Isolation limits spread. Preserved logs help responders trace entry and persistence.
Do not wipe and reconnect quickly to resume work. Rebuilding before cleaning lets hidden access survive. Reconnect only after removal of malicious tools is complete.
- Disconnect affected computers from network and Wi-Fi
- Leave powered-on machines running if responders advise it
- Secure clean backups apart from the network
- Save firewall, endpoint, and login logs
Should you pay to get files back?
According to the FBI, it does not support paying a ransom because payment does not guarantee data recovery and may fund further crime, as stated in FBI ransomware guidance. Decryption keys may fail. Stolen data may still be leaked or sold. Contact a local FBI field office or report at IC3.gov instead.
Share timelines, wallet addresses, and attacker messages. Use clean backups and rebuilt systems for recovery when possible. Treat deadlines as pressure tactics. A rushed payment does not restore trust in affected accounts. Focus effort on verified clean recovery.
When should passwords be reset?
According to CISA's #StopRansomware Guide, issue password resets for all affected systems and associated accounts after the environment is cleaned and rebuilt. The same guidance says to remove malicious persistence before reconnecting. Timing matters because early resets can be stolen again.
Reset service accounts, admin accounts, email, VPN, remote tools, and cloud consoles tied to affected machines. Assume credentials typed or stored on an infected device are exposed. Do not reuse an old password in a new account.
- Change passwords from a known-clean device
- Start with email, identity provider, and admin accounts
- Then reset VPN, backup, and file-share accounts
- Record who reset what and when
How should logins be hardened after recovery?
According to NIST's ransomware profile, use standard accounts with multifactor authentication instead of administrative privileges. It also advises account lockout or authentication delays to block automated password guessing. Fewer admins means fewer paths to full control. Give daily work a standard account.
Reserve admin rights for specific tasks and short sessions. Require a second factor such as an app code or hardware key. Watch for new forwarding rules, unknown devices, and password-change alerts. Lockouts and delays slow guessing attacks but do not replace review. Remove old sessions and unknown authorized apps.
Do you need a freeze, alert, or credit check?
According to the FTC, a credit freeze is free, does not affect scores, and blocks new credit accounts in your name until lifted, as explained in FTC guidance on freezes and fraud alerts. Freeze at Equifax, Experian, and TransUnion separately. Parents may need to act for a minor where allowed. The FTC says consumers need contact only one bureau for an initial one-year fraud alert. That alert tells lenders to verify identity before approval.
An extended seven-year alert requires an identity-theft report. The three bureaus permanently offer free weekly reports through AnnualCreditReport.com. Check each report for unfamiliar accounts, inquiries, or wrong addresses. Victims can report identity theft through IdentityTheft.gov to receive a personal recovery plan and an Identity Theft Report usable in place of a police report to dispute fraudulent accounts. File that report first, then use it to dispute any account the weekly reports reveal.
You Might Also Like
- Royal Ransomware Update 2026: Disclosure, Response, and Open Questions
- Double Extortion Ransomware Guide 2026: What Happened, Who Is Affected, and Next Steps
- Cybersecurity — Triple Extortion Explained: Timeline, Exposure, and Response