Free Tool

Ransomware Scenario Simulator

Ransomware locks your files and demands payment — and in a double-extortion attack, the criminals also threaten to publish your data. This simulator walks you through an attack on a fictional small business, decision by decision, so you can see which choices help, which make things worse, and why the official advice is never to pay.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

What this tool does

Ransomware is malicious software that encrypts a victim's files and demands a payment — usually in cryptocurrency — for the decryption key. In the last few years, most serious attacks have added a second threat: double extortion, where the attackers also steal a copy of the data before encrypting it, and threaten to publish it if the ransom is not paid. Paying does not guarantee the files come back, and it does not guarantee the stolen data stays private. It marks the victim as someone who pays, which invites the next attack.

This simulator puts you in charge of a fictional small business — a family-run bookshop with ten employees — on the morning its computers stop working. At each stage you make a decision: what to do in the first hour, whether to pay the ransom, how to handle the double-extortion threat, and how to recover. Each choice has a consequence, explained immediately, and the simulator ends with a summary of what helped and what did not. There are no right answers to memorise, only the reasoning that security professionals use.

The simulator is built for anyone who could one day face this decision at work or at home: a small-business owner, an employee, a student. It teaches the preparation that makes the decision survivable — backups kept apart from the network, a written plan, someone to call — because the time to prepare is before the attack, not during it. The ransomware guides linked below cover the same ground in depth, with the official guidance and the recovery steps.

Try it

Walk through the scenario. Choose an action at each stage — the simulator explains the consequence before moving on.

How it works

The simulator follows the same stages a real incident follows. First comes detection: someone notices files will not open, or a ransom note appears, and the question is what to do in the first hour. The right answer is containment — disconnect the affected computers from the network so the encryption cannot spread, and do not turn machines off and on in the hope it helps, because that can destroy the evidence that investigators need. Second comes the ransom decision, where the pressure is highest and the official advice is clearest: do not pay, because payment does not guarantee recovery, does not guarantee the data stays private, and marks the victim for the next attack.

Third comes the double-extortion threat: the attackers say they have a copy of the customer list and will publish it unless a second payment is made. The simulator shows why paying the second ransom is no more reliable than the first, and what to do instead — tell the people whose data was taken, report the crime, and let the authorities and the data-protection regulator advise on the next steps. Fourth comes recovery: restoring from backups that were kept apart from the network, rebuilding the affected machines, and changing passwords — because the attackers may have stolen credentials as well as files.

Every stage of the simulator explains the reasoning behind the recommended action, not just the action itself. The point is not to memorise a script but to understand the principles: containment before diagnosis, backups before payment, reporting before silence, and preparation before the attack. A business that has practised those principles survives an attack; a business that has not is left negotiating with criminals at the worst possible moment.

Limitations

This simulator is a teaching exercise with a fictional scenario. Real ransomware attacks are messier, faster and more frightening than a four-stage simulation, and real decisions involve lawyers, insurers, regulators and law enforcement. Nothing here is legal or professional advice for a real incident — if your organisation is attacked, call your IT support, your insurer and the police, and follow their instructions rather than a web page.

• The scenario is simplified: a real attack involves more systems, more uncertainty and more people than a simulator can show.
• The simulator does not name any real ransomware group or show a real ransom note, and it contains no links to leak sites or live threat information.
• If you are infected right now: disconnect the device, do not pay, restore from a backup kept apart from the network, and report the crime to your country's reporting service.

Examples

Example 1 — the first hour. The bookshop's computers show a ransom note at 08:40. The simulator offers two actions: disconnect everything from the network, or keep working and call IT later. Disconnecting stops the encryption spreading to the stock system and the backups; waiting lets it spread. The first hour decides how bad the attack becomes, and containment is the only action that helps in that hour.

Example 2 — the payment decision. The note demands payment in cryptocurrency and promises a decryption key. The simulator shows the official position: paying does not guarantee the key works, does not guarantee the stolen data stays private, and funds the next attack. The bookshop restores from its offline backup instead — it takes a day, but the files come back without paying criminals and without teaching them that this business pays.

Example 3 — the double-extortion threat. The attackers say they have the customer list and will publish it. The simulator shows the response: tell the customers whose data was taken, report the crime, and let the authorities advise. Paying the second ransom buys nothing — there is no way to verify that the attackers have deleted their copy, and they can always come back for more.

Frequently asked questions

Should you pay a ransomware demand?

No — that is the official advice from cybersecurity authorities. Paying does not guarantee your files come back, does not guarantee stolen data stays private, and marks you as someone who pays. Restore from backups kept apart from the network, and report the crime.

What is double extortion ransomware?

An attack where the criminals both encrypt your files and steal a copy of your data, then threaten to publish the stolen data if you do not pay. It adds a second pressure to the same attack, and paying the second demand is no more reliable than paying the first.

What should I do first if I am infected?

Disconnect the affected device from the network so the encryption cannot spread. Do not pay, do not turn the machine off and on repeatedly, and do not try to remove the malware yourself. Then restore from a backup and report the crime.

How can I prepare for ransomware?

Keep backups apart from your network — an offline or separate copy that ransomware cannot reach — keep your software updated, use strong unique passwords with two-factor authentication, and have a written plan and a person to call before an attack happens.

Where do I report ransomware?

To your country's cybercrime reporting service — the Internet Crime Complaint Center (IC3) in the US, Report Fraud in the UK — and to the police if data was stolen. If you are at work, tell your IT department immediately.