No More Ransom (NMR) demonstrates the value of public-private cooperation in disrupting criminal enterprises connected to ransomware. Victims should no longer be forced to pay a ransom or lose their files. By restoring access to their infected systems free of charge, we offer users a third option they previously did not have.
What is ransomware?
Ransomware is a type of malware that prevents or limits users’ access to their systems or devices. The malware demands that they pay a ransom through specific online payment methods within a set timeframe to regain control of their data.
Infection can occur in many different ways, such as:
- Visiting compromised websites.
- Downloading fake application updates or compromised software.
- Clicking on malicious links and attachments embedded in phishing emails.
- Connecting infected external devices (e.g., USB) to the computer system.
What is No More Ransom (NMR)?
NMR is a public-private partnership between law enforcement and industry launched in July 2016.
Through www.nomoreransom.org, the project aims to:
- Assist victims in recovering their encrypted files.
- Increase public awareness of the ransomware threat.
- Offer direct links to national police services in EU Member States and other countries to encourage citizens to report attacks.
How does the system work?
- The victim uploads two encrypted files and the ransom note to NMR’s Crypto Sheriff.
- The Crypto Sheriff compares the information with a list of available decryption tools.
- If there is a positive match, a link to the tools is provided. The victim only needs to follow the instructions to unlock their files.
- If no tool is available at this time, the victim is advised to keep checking in the future, as new tools are added regularly.
Tips for VictimsHow can you avoid ransomware infection?
- Do not click on links in unexpected or suspicious emails.
- Only download official software versions and always from trusted websites.
- Use robust security products to protect your system from all threats, including ransomware.
- Ensure your security software and operating system are up to date.
- Browse the internet with caution and do not click on suspicious links, pop-ups, or dialog boxes.
- If you have accounts with administrator rights, do not use them for your ordinary work.
- As a precaution: back up the data stored on your computer. Keep at least one copy offline.
Infected? What to do next
- Visit https://www.nomoreransom.org/es/index.html to check if you have been infected with any of the ransomware variants for which free decryption tools exist.
- Do not pay the ransom. If you do, you will fund criminals and encourage them to continue their illegal activities.
- Report to the police. The more information you provide, the more effectively they can investigate criminal activity.
- Disconnect your device from the internet or other network connections (such as home WiFi) as soon as possible to prevent the infection from spreading.
- Format the hard drive of the infected device, reinstall the operating system and applications, run available updates, and restore locked files from the backup device (if you have one).
Download the infographic with tips
Download the infographic with key figures from 2020
Access the No More Ransom page
