PanicStation.org
UK USA
us Technology & digital loss

What to do if…
your files suddenly change names or extensions and you do not know why

Produced and maintained by PanicStation.org Published: Last reviewed: Editorial policy USA guide

Short answer

Treat this as possible ransomware until you know otherwise. Disconnect the affected device from networks, pause cloud syncing, and document what you see before trying fixes.

Do not do these things

  • Do not keep the device online while you experiment.
  • Do not rename files back, delete ransom notes, or run random “decryptor” tools you found online.
  • Do not plug in extra USB drives or external drives to “back up” the affected device.
  • Do not wipe or reinstall immediately if you may need IT help, insurance records, or a report.
  • Do not decide about payment in a rush.
  • Do not pay unsolicited callers, messages, or “recovery agents” claiming to be IC3, the FBI, or a guaranteed recovery service.

What to do now

  1. Disconnect the affected device from networks.

    • Turn off Wi-Fi.
    • Unplug Ethernet.
    • Disconnect from any hotspot.
    • Leave the device disconnected while you check the next steps.

  2. Stop syncing and sharing.

    • Pause OneDrive, iCloud, Dropbox, Google Drive, or any other sync app on the affected device if you can do that without reconnecting.
    • From another trusted device, sign in to the cloud provider and pause sync or disconnect the affected device if that option is available.
    • If a shared drive, NAS, or work server may be involved, disconnect that storage from the network or tell the person who manages it.

  3. Take quick evidence photos.

    • Photograph or screenshot ransom notes, changed file extensions, error messages, and folder names.
    • Write down the time you first noticed the change.
    • Write down anything that happened just before it, such as opening an attachment, installing software, clicking a link, or connecting a drive.

  4. Check for spread without reconnecting the suspect device.

    • Use a different trusted device to check whether cloud folders show the same renamed or unreadable files.
    • Ask other people who use the same shared drive whether they see changed names or extensions.
    • If another device shows the same changes, disconnect that device too.

  5. Contact the right support channel.

    • For a work or school device, contact IT or security and say: “Possible ransomware or file encryption; files renamed or extensions changed.”
    • For a personal device, contact a reputable computer repair or incident-response professional before restoring backups or running recovery tools.
    • If you have cyber insurance, use the insurer’s incident contact route before making payment or recovery decisions.

  6. Report safely when you can.

    • You can report ransomware to the FBI Internet Crime Complaint Center.
    • Type www.ic3.gov directly into your browser address bar.
    • Avoid sponsored search results and lookalike sites.
    • IC3 will not charge a fee to recover money or files.
    • You can also contact your local FBI field office.

  7. If file names or extensions keep changing after disconnection.

    • If you cannot fully disconnect the device, or changes still appear to be actively happening, power the device down.
    • Do not turn it back on or reconnect it until IT or a trusted professional tells you what to do next.

  8. Preserve samples only with care.

    • Keep screenshots and notes.
    • Do not attach new storage to the suspect device just to collect samples.
    • If IT, law enforcement, or a trusted incident-response professional asks for a ransom note or affected file sample, follow their instructions after the device is isolated.

What can wait

  • You do not need to decide right now whether to pay, wipe, rebuild, or replace the computer.
  • You do not need to identify the malware family today.
  • You do not need to start restoring backups immediately.
  • You do not need to message every contact or change every password before containment, unless IT or a trusted professional tells you there is an account compromise.

Important reassurance

This is a common moment to freeze or click quickly. Slowing down, disconnecting the device, and stopping sync can limit the damage and buy time for safer recovery decisions.

Scope note

These are first steps only. Recovery, backup restoration, account security, forensic review, insurance, and notifications may need specialist help based on your device, network, and files.

Important note

This is general information, not legal, forensic, cybersecurity, financial, or professional incident-response advice. If you are unsure what caused the file changes, treating it as possible ransomware at first is usually the safer path.

Additional Resources

Closely connected guides that may be useful during the same situation or its immediate aftermath.

About this guide

This guide was produced and is maintained by PanicStation.org using its published editorial process. Official and specialist sources are checked where relevant, and AI-assisted tools may be used for drafting, organisation, and consistency checks. The site operator remains responsible for publication, revision, and removal decisions.

Support us