Ransomware-Encrypted Data: Why Report to the Police or PA05, and How Can You Protect Your Data?

1. Establish what happened

An unreadable file alone does not prove Ransomware. Correlate widespread changes, ransom notes, altered contents, service failures and logs. Hardware faults, RAID problems, permissions and database corruption can produce similar symptoms. Keep samples and record observations without assigning an attacker identity from an extension.

2. Contain the incident and preserve the source

1. Isolate affected systems and suspicious access paths. Protect unaffected backups from compromised hosts and accounts.
2. Record discovery time, screenshots, filenames, ransom notes, RAID status and actions already taken.
3. Stop resets, formatting, experimental rebuilds and unverified decryptors on the only copy.
4. Arrange controlled copies or drive images when technically appropriate. Record who copied what, when, and integrity hashes where useful.
5. Assign an IT coordinator and involve management and the legal/data protection contact early.

There is no universal power-off instruction. Ongoing encryption may demand urgent intervention; volatile evidence may require specialist collection. Document the decision and its reason.

3. NAS, SQL Server, ESXi and Windows Server

• NAS/RAID: preserve drive order, serial numbers, configuration and disk condition. Do not initialise volumes or rebuild as an experiment. Avoid repeated heavy scans on failing hardware.
• SQL Server: retain MDF, NDF, LDF, backup sets and relevant logs. Do not attempt destructive repair or restore over the sole source. Test independent copies.
• ESXi: retain VM configuration, VMDK descriptors, extents and snapshot chains. Avoid deleting or consolidating snapshots, creating datastores or placing new VMs on the affected storage.
• Windows Server: preserve available logs and relevant service/task information safely. Coordinate from a clean device and address compromised credentials.

A snapshot on the compromised system is not an independent safe backup. Recover into an isolated clean environment, then validate the data and application before returning to service.

4. Avoid preventable data loss

Formatting, incorrect RAID reconstruction and overwriting may destroy metadata or recoverable content. A decryptor labelled for the same family may still be incompatible with the actual variant. Keep the original and test copies, then validate outputs with the real application.

Encryption transforms content and may be reversible when the necessary conditions are met. Deletion may remove references while some content remains until reused. Destructive overwriting replaces the old information; recovery of that replaced information cannot be promised. TRIM, hardware damage and missing keys require separate assessment.

5. Why TUNGTEK recommends contacting the Police

The incident may involve unlawful access, destruction, theft or extortion. Early contact establishes a competent reporting channel and supports coordination while evidence is still available. PA05 is a provincial/municipal Police specialist unit for cybersecurity and high-tech crime prevention. It is not the only possible point of contact: local commune/ward Police or another competent receiving authority can provide guidance.

Use contact details published through official local Police channels. The Ministry of Public Security publishes guidance on reporting suspected crime. Reporting does not guarantee successful extraction of encrypted data or an immediate finding of data theft.

6. Prepare a clear initial record

• Organisation details, authorised representative and contact person.
• Last known normal operation, discovery time and person discovering the incident.
• Affected systems and estimated scope, including backups.
• Observed extensions, ransom notes, screenshots and verified unusual account activity.
• Containment, shutdown, copying and recovery actions already performed.
• Evidence inventory, responsible custodian and available logs or images.

Do not post customer databases, personal data, passwords or private keys publicly. Use authorised, secure handover channels and keep a receipt or inventory where appropriate.

7. Distinguish reporting duties and deadlines

Legal references reviewed for 25 October 2026: Cybersecurity Law 116/2025/QH15 took effect on 1 July 2026. Article 40(1)(c) addresses information-system owners reporting cybersecurity incidents to the specialist authority of the Ministry of Public Security or Ministry of National Defence. This is separate from an assertion that every victim must report specifically to PA05 within 72 hours.

Under Article 23 of Personal Data Protection Law 91/2025/QH15, controllers, controller-processors and third parties must notify the specialist personal data protection authority within 72 hours of detecting a violation where the statutory harm conditions apply: potential harm to national defence, national security or public order, or infringement of the data subject's life, health, honour, dignity or property. Processors must promptly inform their controller or controller-processor. Decree 356/2025/ND-CP, Article 28 and Form 08, addresses notification content and procedure. Both instruments took effect on 1 January 2026.

A separate 24-hour consumer-information notification requirement may apply under Article 19(3) of the Consumer Rights Protection Law. The Ministry of Public Security explains the distinct deadlines. Have the organisation's legal/data protection contact assess applicable duties immediately; do not wait for the investigation to end. These are general references, not a case-specific legal opinion.

8. Encryption does not establish data theft

Ransomware may both encrypt and exfiltrate data, but an encrypted file or attacker threat alone does not establish exfiltration. Review access records, traffic, accounts, tool traces and other evidence. Successful extraction of encrypted data also does not establish that no copy was taken. Separate observed facts from questions still being investigated.

9. Coordinate recovery and investigation

Recovery need not automatically wait until the Police have completed their work. Management authorises scope and priorities; the competent authority handles its legal remit; the recovery provider preserves, copies, tests and explains technical limits. Follow any lawful sealing, seizure or examination requirements and coordinate before altering a preserved source.

Keep a handover inventory with device/file identifiers, time, personnel and integrity hashes where relevant. A hash helps check integrity; it does not by itself establish provenance or evidentiary meaning. Agree access, confidentiality, copy storage and report recipients before work begins.

TUNGTEK supports technical assessment, data extraction and controlled recovery within the owner's authorisation. We do not make law-enforcement findings or guarantee successful extraction of encrypted data.

10. Quick response checklist

• Record discovery and retain the ransom note.
• Contain affected access and protect remaining backups.
• Stop destructive or experimental actions on the original.
• Assign IT, management and legal/data protection contacts.
• Contact a competent Police authority and separately assess notification duties.
• Work on controlled copies and validate recovery in a clean environment.

Frequently asked questions