Help
Data encrypted, ransom demanded: what to do now
Files no longer open and a ransom demand is on the screen? That is ransomware. It hits businesses, clubs and private people alike. Stay calm and go through this in order.
Right away
- Disconnect affected devices from the network and the internet: pull the cable, turn off Wi-Fi. Do not switch them off if experts are to examine them.
- Disconnect your backups as well, and protect them.
- Photograph the message on the screen and note what happened when.
Do not pay
- Do not pay the ransom and do not answer the criminals. The BSI advises the same: paying does not guarantee you get your data back.
- If they also threaten to publish stolen data, say so when you report it.
Report it
- Report it to the police right away.
- Private people: through the online police station of Schleswig-Holstein.
- Businesses, public bodies and associations: the Central Cybercrime Contact Point at the State Criminal Police, phone +49 431 160 42727, cybercrime@polizei.landsh.de.
- If personal data is affected, the data protection authority must generally be told within 72 hours (Art. 33 GDPR).
- If you have cyber insurance, tell them early. They often set requirements.
Rebuild
- Clean the systems first. This often takes experts.
- Then restore your data from a clean backup.
- Change all passwords from a clean device.
Sources and further help
- BSI: ransomware (German) (opens in a new tab)
- Police: Central Cybercrime Contact Points (German) (opens in a new tab)
- Online police station of Schleswig-Holstein (German) (opens in a new tab)
Last updated: 4 November 2026
Personal help
Stuck?
Silvra is based in Dithmarschen. Write to us about what happened. We read every report personally, help you assess the situation and, by arrangement, come to you. We cannot promise a fixed response time.