Do not pay, reply, or investigate alone. Preserve the original Bitcoin demand, notify your organization’s incident lead through a trusted channel, and let the response team determine whether the message is a bluff, ransomware, data theft, or some combination. The team should isolate affected systems, preserve evidence, involve leadership and legal advisers, and report promptly. In the United States, that normally includes the FBI’s Internet Crime Complaint Center (IC3), the FBI, or other agencies designated in the organization’s incident plan.
What should I do if my company gets a Bitcoin ransom demand?
Treat a workplace Bitcoin demand as a potential cyber incident even when it looks implausible. A criminal may be demanding payment after encrypting files, threatening to publish allegedly stolen data, or sending a bluff designed to make someone panic. The message itself does not prove that the sender accessed the company’s systems or possesses the data described.
As an Amazon Associate I earn from qualifying purchases.
Your immediate job as an employee is to preserve the message and alert the people who are authorized to respond. Use the organization’s incident-response process, not a personal account or an improvised technical fix. Do not click a link in the demand, download a supposed decryptor, send cryptocurrency, or negotiate with the sender.
Recommended Free Tools
Use a trusted reporting channel
Contact IT security, the security operations team, your manager, or the incident commander using a phone number, chat workspace, or email address already known to be legitimate. If the demand arrived by email, do not simply reply to it or forward it to an unverified address. If your organization has an emergency incident number, use that route and say that a cryptocurrency extortion demand has been received.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Record any deadline shown in the message, but do not let a countdown override the response plan. Attackers often use deadlines to force a hurried decision. The incident lead should decide who needs to be told, which systems must be isolated, and how communications will be handled.
Do not alter the evidence
- Keep the original email, chat message, ransom note, attachment, or file where responders can collect it.
- Record the attacker’s email address, usernames, websites, messaging handles, phone numbers, and cryptocurrency wallet address.
- Write down the cryptocurrency type, requested amount, deadline, payment instructions, and any transaction identifier.
- Preserve screenshots only as a supplement; screenshots do not replace the original message and its metadata.
- Do not delete the note, rename encrypted files, wipe a device, or rebuild a server unless the response team directs you to do so.
How the incident team determines what happened
A demand can point to different incidents, and the response differs depending on what is actually affected. The response team should establish facts before deciding on containment or recovery.
Encryption-based ransomware
Ransomware commonly encrypts files and leaves a note demanding cryptocurrency for a key or decryption program. Signs can include files that no longer open, a new extension on many files, inaccessible shared drives, disabled services, or ransom notes appearing across devices. The team should identify the first affected systems, the scope of encryption, and whether the attacker still has access.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteData-only extortion
Some attackers threaten to publish or sell allegedly stolen information without encrypting systems. They may provide sample documents or screenshots as proof. A threat and a sample do not establish the full extent of access, so responders must investigate what data may have been viewed or copied, when it happened, and whether credentials or systems remain compromised.
A bluff or mass-mailing
Some demands are sent broadly and contain no evidence of access. That still warrants a coordinated assessment at work, but it does not justify sending money or granting the sender additional information. Security staff can compare the claim with logs, endpoint alerts, backup status, and reports from employees.
Contain affected systems without destroying evidence
CISA’s #StopRansomware Guide, revised October 19, 2023, advises determining which systems are impacted and immediately isolating them. Isolation prevents an intruder or malware from moving to additional devices while investigators establish the scope.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
What employees should and should not do
- If instructed by the response team, disconnect a suspected workstation from wired and wireless networks, but leave it powered on unless responders provide different instructions.
- Do not connect an affected computer to another network, plug in removable media, or copy encrypted files to a personal device.
- Do not run an unapproved decryptor, antivirus “cleaner,” registry repair, or forensic utility on the affected machine.
- Do not change passwords from a suspected compromised device. Use a clean device and the process supplied by security staff.
Broader network isolation
If many systems or an entire subnet appear affected, the response team may need to isolate a larger network segment. That decision belongs to qualified responders because shutting down services can affect safety, operations, backups, and evidence. Employees should follow the incident commander’s instructions rather than unplugging equipment throughout the office.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Preserve logs, images, and volatile evidence
Evidence can disappear when systems are rebooted, cleaned, or overwritten. Responders should preserve relevant security and system logs and, when appropriate, create system images, capture memory, collect precursor malware samples, and preserve other volatile evidence. The exact collection method depends on the device and the organization’s forensic capability.
Do not wipe or rebuild an affected system until responders decide that necessary evidence has been captured and that recovery can proceed safely. Keep a timeline of when the demand was found, who received it, which systems showed symptoms, and what actions were taken. A simple timeline helps investigators correlate email, identity, endpoint, firewall, cloud, and backup records.
Who should be notified inside the organization?
The incident plan should identify the people responsible for technical response, business decisions, communications, insurance, and legal review. Typical notifications include:
- Incident commander or security lead: coordinates decisions, evidence handling, and status updates.
- IT, security, and infrastructure teams: identify affected devices, accounts, applications, networks, and backups.
- Executive leadership: makes business decisions and authorizes extraordinary actions.
- Legal and privacy counsel: assesses contractual duties, regulatory requirements, privilege, and possible notification obligations.
- Cyber-insurance carrier and approved responders: confirms whether the policy requires a specific panel, notification path, or authorization before engaging vendors.
- Managed service or security provider: supplies additional monitoring, containment, or forensic capability when the plan includes one.
- Communications and human-resources teams: prepare consistent employee, customer, partner, and public messages when needed.
Use the contact list in the response plan. An attacker may impersonate an executive, help-desk worker, or security vendor, so verify urgent instructions through a second trusted channel.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →How to report a Bitcoin extortion demand in the United States
U.S. organizations should report promptly rather than waiting to determine whether they will pay. The FBI says organizations should report ransomware incidents whether or not a ransom is paid. Available routes include the FBI’s Internet Crime Complaint Center (IC3), a local FBI field office, and, when appropriate, the U.S. Secret Service. The organization’s legal and incident-response teams can select the correct sequence and preserve confidentiality where available.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Submit an IC3 complaint at www.ic3.gov. If cryptocurrency was transferred, include the transaction information and wallet details. The FBI’s cryptocurrency-scam guidance also directs victims to report quickly and provide as much transaction information as possible.
Information to assemble for a report
- Known ransomware family or variant, if responders can identify it.
- File extension added to encrypted files and examples of affected filenames.
- Attacker email addresses, websites, chat handles, phone numbers, and wallet addresses.
- Cryptocurrency type, amount demanded, deadline, and any payment instructions.
- Whether a payment was made, the amount, the wallet used, and transaction identifiers.
- Dates and times of discovery, suspected intrusion, encryption, data theft, and communications.
- Systems, accounts, cloud services, and business operations believed to be affected.
- Evidence of data exposure, including the categories of information allegedly taken.
Do not delay a report while trying to identify the attacker with certainty. Attribution and recovery are not guaranteed, but early, detailed information can help investigators connect related incidents and trace cryptocurrency movement.
Should an employer pay a Bitcoin ransom?
Employees should never make or promise a payment. The FBI states, “The FBI does not support paying a ransom in response to a ransomware attack.” CISA, the FBI, and the NSA strongly discourage payment because it can encourage further criminal activity and does not guarantee that files will be restored or that stolen data will be deleted.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPayment is not a technical recovery plan. A criminal may provide a defective key, demand more money, continue extortion, sell the data anyway, or leave persistence in the network. Paying can also complicate investigations and create legal, sanctions, insurance, accounting, and contractual issues that require professional advice.
Who can make the decision?
Only authorized organizational leadership, working with legal counsel, the insurer, and qualified incident-response advisers, should evaluate the business options. That evaluation can include the availability and integrity of backups, safety and operational consequences, evidence of data theft, restoration time, contractual commitments, and applicable legal restrictions. The evidence does not support a universal claim that every ransom payment is illegal, nor does it make payment a guaranteed route to recovery.
Negotiation, if leadership considers it at all, should be handled by experienced responders and counsel—not by the employee who received the message. Do not reveal internal systems, backup locations, security tools, staffing, or willingness to pay in a direct reply.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
If cryptocurrency has already been sent
Report the payment immediately through the organization’s incident process and to law enforcement. Preserve the sending wallet, receiving wallet, transaction hash, exchange or custodian records, timestamps, amount, currency, and every message exchanged with the attacker. Do not send a second payment without explicit authorization from leadership and legal advisers.
Secure the account or wallet used for the transfer from a clean device, following advice from the organization’s security and financial teams. Do not assume that moving remaining funds or deleting the wallet will erase evidence. The FBI’s cryptocurrency-scam guidance asks victims to provide transaction information when reporting.
Data exposure, privacy, and notification duties
If attackers claim to have copied data, the organization should activate its breach-assessment process. Counsel and privacy specialists need to determine what information was involved, whose information it was, which jurisdictions apply, and whether contractual, regulatory, or statutory notices are required. Those duties vary by country, state, sector, and the type of data; they cannot be determined from a ransom note alone.
Employees should not notify customers, regulators, journalists, or affected individuals independently. Premature or inaccurate statements can create additional harm. Route external questions to the designated communications and legal contacts, and preserve a record of what the organization knew and when.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Communicating during the incident
Use one approved source of truth for updates. Messages to staff should explain what actions are required—such as disconnecting a device, avoiding a shared drive, or using an alternate service—without publishing sensitive investigative details.
Free tools Windows power users keep installed
One-click scans. No signup required.
- State which services are unavailable and where employees should get verified updates.
- Tell recipients how to report suspicious messages or symptoms.
- Warn against contacting the attacker, sharing screenshots publicly, or spreading unverified claims.
- Assume that email and collaboration accounts may be monitored if those systems are affected; use the alternate channel specified in the plan.
Recovery after containment
Recovery begins only after responders understand the compromise well enough to prevent immediate reinfection. They should identify the initial access path, remove persistence, reset affected credentials, patch exploited weaknesses, validate backups, and monitor restored systems. Backups should be checked for both integrity and malware contamination before they are used.
Restore the highest-priority services according to the organization’s business-continuity plan. Keep affected systems segmented while they are validated, and monitor authentication, administrative activity, endpoint alerts, and unusual outbound traffic. Document decisions, evidence collected, restoration steps, and remaining uncertainty for leadership and any later regulatory or insurance review.
Common mistakes that make an extortion incident worse
| Mistake | Why it creates risk | Safer response |
|---|---|---|
| Replying from a personal account | It can expose more information and bypass evidence collection. | Preserve the message and use a trusted internal reporting channel. |
| Paying to stop a countdown | Payment may not restore files or prevent publication and can encourage more demands. | Let authorized leadership evaluate options with legal and response advisers. |
| Rebooting, wiping, or rebuilding immediately | Volatile evidence and forensic artifacts may be lost. | Ask responders how to isolate and preserve the device. |
| Running an online decryptor or cleanup tool | It may destroy evidence, spread malware, or make recovery harder. | Use only tools and procedures approved by the incident team. |
| Assuming a data-threat claim is proof | The sender may exaggerate access or use recycled information. | Have responders validate the claim through logs, samples, and forensic analysis. |
| Keeping the event internal | Delayed reporting can reduce investigative options and complicate notification decisions. | Escalate promptly under the incident plan and report through the appropriate authorities. |
How the response changes by situation
Only one employee received a suspicious demand
Preserve the message and report it. Security staff should check whether the sender used information from a real account compromise, whether links or attachments were opened, and whether other employees received the same campaign. Do not dismiss it as spam solely because no files are encrypted.
Files are encrypted on several computers
Tell the incident lead immediately, disconnect affected systems as directed, and stop using shared drives that may spread the intrusion. Responders should determine the affected subnet, protect backups, capture evidence, and prioritize restoration only after containment.
The attacker claims to have stolen customer or employee data
Preserve the samples and claims without redistributing sensitive files. Legal and privacy teams should start the breach assessment while responders investigate access and exfiltration. Keep communications controlled until facts and notification duties are established.
The message reached a personal device used for work
Do not forward company material to a personal account. Contact the organization through its verified emergency channel and follow instructions for preserving the device. If personal accounts or payment credentials were involved, tell both the organization and the relevant financial institution or law-enforcement contact.
What to prepare before an incident
A written response plan makes a deadline-driven demand less disruptive. It should identify incident leaders and backups, out-of-band communications, authority to isolate networks, evidence-preservation procedures, legal and insurance contacts, reporting routes, critical services, and tested backups. Staff should know how to recognize a demand and where to report it without searching an allegedly compromised directory.
Run exercises that include both encrypted systems and data-only extortion. Test whether the organization can reach its incident commander, preserve logs, restore clean backups, notify required parties, and keep employees informed when normal email or chat is unavailable.
Key contacts for U.S. organizations
- Internal: incident commander, IT/security, executive leadership, legal or privacy counsel, cyber insurer, and approved response provider.
- Federal: FBI Internet Crime Complaint Center (IC3) at www.ic3.gov, a local FBI field office, CISA, and, as appropriate, the U.S. Secret Service.
- Outside the United States: use the national cybercrime reporting authority, police, privacy regulator, and sector regulator identified by local counsel. U.S. reporting routes and legal deadlines do not automatically apply elsewhere.
Official guidance changes, so the organization should verify current contact routes when maintaining its plan. CISA’s joint ransomware guidance was revised October 19, 2023; the FBI IC3 ransomware page does not display a publication date in the available material. Treat those documents as operational guidance, not a promise of attribution, recovery, or a decryptor.
The practical rule
A Bitcoin extortion note at work is a trigger for coordinated incident response—not a personal negotiation. Preserve the demand, alert the incident lead, isolate affected systems only as directed, protect evidence, report promptly, and leave any payment decision to authorized leadership with legal and qualified response advice.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
