In a ransomware incident, what typically happens after encryption of files?

• A. Ransom note is presented and payment requested.
• B. System automatically restores from backup.
• C. Attacker provides decryption key for free.
• D. Company immediately files a police report.

Answer: (A)

After files are encrypted in a ransomware incident, the attacker typically presents a ransom note and requests payment in exchange for a decryption key or tool. This is how the attacker monetizes the breach—locking data and demanding payment to unlock it. The note usually outlines what happened, how to pay (often in cryptocurrency), a deadline, and threats such as data exposure if payment isn’t made.

Restoring from backups isn’t something the attacker does; backups are a defender’s option to recover access, not an action the malware performs. A decryption key for free would defeat the attack’s purpose, so it’s not the usual outcome. Filing a police report may happen as part of the broader response, but it’s not the immediate consequence of the encryption itself.