My files are locked and someone demands a ransom. What should I do?

Reviewed answer

Disconnect the device and preserve evidence; a ransom does not guarantee recovery.

Disconnect Wi-Fi and Ethernet and unplug external drives to limit further damage.
Photograph the ransom message. Use a different trusted device to contact official device support or your employer's IT team.
In the US, report at IC3.gov. Avoid random decryptor downloads or anyone promising guaranteed recovery.
Restore from a verified backup only after the affected device has been safely cleaned or rebuilt.

Get help if

Files on shared folders or connected backups are also changing. Tell anyone responsible for those systems immediately.