Regardless of the size of your business, the amount of ransom requested, the extent of the damage, or the ransomware recovery method you choose, you should always report a ransomware attack to law enforcement agencies. What to do about ransomware What to do about a ransomware attack Step 1: understand your situation. You have been infected with malware. ... Step 2: lock it down. For now, all we know is that you are infected. ... Step 3: Shutting Down Patient Zero. ... Step 4: identify the infection. ... Step 5: review your backups. ... Step 6: Paying the ransom. ... Step 7: decrypt.