Visit our new website
Our new website is coming soon - you can view some of the new features by clicking the link. Check back for updates on careers, firearms and explosives licensing, crime prevention advice and more.
Visit our new website
Search Site

Leave page quickly

Ransomware and Malware

This section contains further advice if you have received a ransomware demand. Ransomware is like Malware as it is designed to stop your computer/device working properly. However this attack comes with a demand usually for money to release the data on the device.


What to do now?


  • Take a screenshot of the ransom message
  • Save any e-mails but do not forward them on to anyone, including the police.
  • If your computer has been locked by ransomware, seek professional advice from a trustworthy source.
  • Do not pay the ransom demand.


This should be reported directly to Action Fraud via their online reporting tool or via the telephone: 0300 123 2040. Action Fraud are the National Fraud and Cyber Recording Centre.

If you are suffering a live cyber threat that is in progress, call Action Fraud, do not use the online reporting tool. In an emergency (click here to see examples) please call 999 or the alternative emergency number 112; for the deaf, hard of hearing or speech impaired call 18000 to use Next Generation Text Service (replaces TextRelay); or use emergencySMS. Otherwise please call 101 (the national police non-emergency number), or .

We may also ask you to report it to Action Fraud as part of the national initiative relating to cybercrime.

Contact your bank where appropriate, to make them aware of the incident so that they can take appropriate steps to protect your account.

What happens next?

Action Fraud will record the details of the crime and pass to the National Fraud Intelligence Bureau (NFIB) to conduct initial checks. Based on their findings they will allocate the investigation onto the most appropriate police force to deal with the crime. This may be based on where the suspect has been located or where the NFIB feel the crime best sits. Action Fraud will send you a letter notifying you of your crime reference number and which police force has been allocated your crime. You can also track your crime on the Action Fraud website.

The police will undertake a proportionate investigation where appropriate. Due to the volume and nature of cybercrime, contact from our staff may happen some time after the event, so please include as much detail as possible in your initial report to assist any investigation, keeping a copy for your records as reference for any follow up contact. The police may also make a referral to Victim Support for you, here is more Victim and witness information.

What else can I do?

  • To detect and remove ransomware and other malicious software that may be installed on your computer, run a full system scan with an appropriate, up-to-date, security solution.
  • Do not reply to, or click on links contained in, unsolicited or spam emails from companies or individuals you do not recognise. 
  • Visit only websites you know to be reputable.
  • Always install updates to software and apps - including operating systems - as soon as prompted.
  • Ensure you have effective and updated antivirus/antispyware software and firewall running before you go online.
  • Regularly back up all your data, including to a USB-connected device stored remotely from your computer. This is because some ransomware can also infect your cloud-based storage.