Ransomware: what should a company do when its files are encrypted and a ransom demand appears on screen? According to the Federal Office for Cybersecurity (FOCS), the first step is to cut the affected machines off from the network, then secure the backups, preserve the traces of the attack, file a criminal complaint and make the notifications required by law.
This guide follows the response step by step. How the attack works, its entry points and the Swiss figures are covered in our report on ransomware in companies.
The principle set out by the FOCS on its page "Ransomware – what to do?" fits in one sentence: stay calm and act deliberately. The primary goal is not to restart as quickly as possible, but to discover the infection path and prevent a new infection.
What is the first step when faced with a ransom demand?
Isolate. The FOCS asks for infected systems to be disconnected immediately: unplug the network cable from the computer and disable any wireless adapters.
The joint press release of the Office of the Attorney General of Switzerland (OAG), the Federal Office of Police (fedpol) and the FOCS of 16 October 2025 goes further. In the event of an incident, it recommends first blocking all Internet connections: web, email, remote access and virtual private networks (VPN) between sites.
The second priority is the backups. The same press release asks for them to be checked and secured immediately.
The third step is to bring in the right people. The guide "IT emergency management" from the insurer Helvetia advises contacting all the required internal contacts and asking users what they did and observed. It also recommends keeping a printed emergency plan: during an attack, the IT system may be inaccessible, and the contact list along with it.
Why should machines be neither wiped nor restarted?
Because the traces of the attack are also evidence. The FOCS recommends having the memory and hard drives backed up by a specialist before any repair attempt or any restart. According to the office, these actions otherwise make forensic analysis, that is, the technical investigation into the intrusion, almost impossible.
Log files are the raw material of this investigation. They make it possible to identify the affected systems, for example access to network drives. Those of mail servers, proxy servers and firewalls reveal the attackers' URLs and IP addresses. The FOCS advises blocking these addresses on the firewall or proxy, and keeping the logs.
The decision to carry out a forensic analysis is made early. It matters above all if the company wants to file a criminal complaint: the FOCS then recommends informing the criminal prosecution authorities from the outset and discussing the next steps with them. Without in-house expertise, it advises calling in a specialised firm.
One last reflex: do not throw away the encrypted data. The authorities have sometimes obtained keys during their investigations, the FOCS points out; encrypted files that are kept may perhaps be decrypted later. Helvetia adds that the facts relating to the incident should be documented as they unfold.
Who should be notified, and within what time frame?
Several notifications run in parallel, each with its own logic. The table lists those cited by the FOCS, the Federal Data Protection and Information Commissioner (FDPIC) and the Helvetia guide.
| Recipient | Why | When |
|---|---|---|
| Cantonal police where the company is based | Criminal complaint; recommended in all cases by the OAG, fedpol and the FOCS | Early, before any action on the ransom |
| FOCS, critical infrastructure operators | Reporting obligation in force since 1 April 2025 | 24 hours after detection, 14 days to complete |
| FOCS, other companies | Voluntary reporting | No set deadline |
| FDPIC | Data security breach posing a high risk to individuals (Article 24 of the Data Protection Act) | As soon as possible |
| Cyber insurer | Notification recommended by Helvetia; the insurer can provide a network of experts | From the incident onwards, if a policy exists |
For critical infrastructure, the reporting question is quickly settled. According to the FOCS, a cyberattack must be reported in particular when it involves blackmail, threats or coercion. Our analysis: ransomware, by its very nature, meets this criterion. Those subject to the obligation include energy, drinking water and transport companies, as well as cantonal and municipal authorities; the law provides for fines in the event of failure to report.
On the data protection side, the criterion is different. The law speaks of a data security breach when personal data are lost, deleted, destroyed, altered or made accessible to unauthorised persons, the FDPIC guide updated on 23 April 2025 points out. The notification goes through its DataBreach online form, which issues a confirmation. The same Article 24 governs informing the persons concerned.
Finally, the criminal complaint is not a formality. Victims who forgo it for fear of damage to their reputation deprive the investigation of leads, stress the OAG, fedpol and the FOCS. A dated example: in November 2026, the Gleis D medical centre in Chur filed a complaint and reported the incident to the FOCS and the FDPIC, as noted in our article on the cyberattack on Gleis D in Chur.
What should employees, customers and the media be told?
Little, but quickly and accurately. On its page "Cyberattack – how to communicate?", the FOCS sets two rules of order: internal before external, and the company's own channels before the media. Before any public announcement, everyone concerned must know the facts and a shared official version.
The timing of disclosure needs weighing. The FOCS invites companies to check two points: does publication hinder the police investigation and the forensic analysis? Has the information been verified? As a rule, the office prefers fast, proactive and transparent communication to a crisis kept secret.
The office divides communication into three phases: announcing the attack, managing it, and then its end. Together with the cantons of Zurich and Vaud, it published on 8 March 2024 Word templates for each phase of a ransomware attack, in a version for companies, as well as a Q&A template for the media. The State of Vaud also publishes ransomware quick-reaction sheets, one for users and one for technicians.
Distinguishing what is confirmed from what is claimed avoids having the narrative dictated by others. During the cyberattack on Holcim in November 2026, the Zug-based group confirmed limited access and a theft of data; the volume of 360 GB, for its part, came from the hackers. Customers also deserve a warning: Gleis D warned its patients of possible fraud attempts. Helvetia offers a template letter to customers after a confirmed cyberattack.
How should the decision on the ransom be prepared?
By first checking every other option. This guide does not go into the debate on payment; it sticks to the official position. The FOCS advises against paying: nothing guarantees that the criminals will not publish the data, and every successful extortion finances new attacks. The office strongly recommends discussing any contemplated payment with the cantonal police beforehand.
Several recovery options exist even without a backup, according to the FOCS. Decryption is sometimes possible if:
- the ransomware has not encrypted or deleted the Windows shadow copies;
- there are snapshots of virtual machines or earlier versions of the files in a cloud service;
- the deleted files can be restored through forensic analysis;
- the encryption contains errors, or the key is already known.
For this last case, the FOCS refers to the No More Ransom website, a project of the Dutch police and Europol in which the Confederation takes part. It helps identify the malware and offers keys that are already known.
When can business resume?
After reinstallation, not before. The FOCS considers it necessary to reinstall the infected systems before restoring the data, with an operating system taken from a trusted medium.
Resuming operations does not close the incident. Helvetia advises closing the gaps revealed by the attack, closely monitoring the network and systems to detect any new attempt, and then reviewing rules and processes. Our analysis: this lessons-learned review is also the moment to write the emergency plan that was missing.
Key figures
- 24 hours: deadline for a critical infrastructure operator to report to the FOCS, followed by 14 days to complete the report.
- 1 April 2025: entry into force of the reporting obligation, decided by the Federal Council on 7 March 2025.
- Around 200 Swiss companies fell victim to the Akira group alone, according to the press release of 16 October 2025.
- 4 to 5 cases linked to Akira per week, a record in Switzerland according to the authorities.
- 3 phases of crisis communication, with templates published by the FOCS on 8 March 2024.
Other Swiss cases can be found in our section on cyber threats and attacks.
Sources
- Federal Office for Cybersecurity: "Ransomware – what to do?"
- Federal Office for Cybersecurity: "Cyberattack – how to communicate?"
- Federal Office for Cybersecurity: "Information on the reporting obligation"
- OAG, fedpol and FOCS: "Cybercrime: the AKIRA group steps up its activities", press release of 16 October 2025
- Federal Data Protection and Information Commissioner: "Guide to reporting data security breaches"
- Helvetia: "IT emergency management"
- State of Vaud: "Responding to a cyberattack"
