Report Ransomware Attack

Ransomware is a type of malicious software that encrypts files on a computer or network, making them inaccessible to the user. The attacker then demands a ransom—usually in cryptocurrency—in exchange for a decryption key.
Ransomware typically spreads through phishing emails, malicious links, or vulnerabilities in software. Once activated, it can lock critical data, disrupt business operations, and even spread across entire networks. Paying the ransom doesn’t guarantee file recovery, as attackers may not provide a working decryption key or could demand additional payments.

Organisation

Select organisation (Required)

Sharing Options

Select sharing level. If unsure, choose "Share with my Organisation Only". The platform administrator may change this option if appropriate.

Share with my Organisation Only
Report can be viewed by your Organisation Only

Share with UnderServed Community
Report can be viewed by UnderServed Community

Incident Details

Date of Attack: (Required)

Time of Attack: (Required)

Ransomware Name: (Required)

Ransom Amount Demanded:

Crypto Wallet Address (where attacker wants payment to be made):

Description: (Required)

Attacker Information:

Attacker Name, Handle, Group Name:

Attacker Email Address:

Attacker Phone Number:

Upload Ransomware Sample: Allowed file types: .exe, .dll, .bin, .jar, .ps1, .vbs, .js

Upload Screenshot of Ransomware Pop-Up: Allowed file types: .png, .jpg, .jpeg, .pdf

A Simple Way to Report Cyber Security Incidents