How to Recover From a Ransomware Infection on Mac

Mac-specific ransomware response and recovery.

JDCS

By Jordan Dickson · Reviewed by CSG Security Engineers

Updated June 2026 · 1 min read

Step 1: Isolate the Mac

Disconnect from Wi-Fi and Ethernet immediately to stop spread to other devices
Disconnect any external drives or Time Machine drives
Do not pay the ransom — it funds further attacks and rarely results in recovery

Step 2: Restore from a clean backup

Time Machine: boot into Recovery (Apple Silicon: hold power → Options) and use Restore from Time Machine
iCloud: documents synced before infection are recoverable from iCloud.com
Restore only files, not system or app folders, to avoid re-infection

Step 3: Wipe and reinstall macOS

If no clean backup exists, the safest option is a clean reinstall:

Boot into macOS Recovery
Choose Disk Utility → Erase the internal disk (APFS, GUID)
Quit Disk Utility and choose Reinstall macOS
Set up as new — do not restore from the infected backup

Tags:

Malware & Viruses

Was this guide helpful?

Know someone who needs this? Send them the guide.

JD

Written by

Founder, CyberSecurityGuides

Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

Reviewed by CSG Security Engineers

More from Device Security

How to Secure Your Microsoft Account

Lock down the Microsoft account behind your PC, Xbox and inbox: password, two-step verification, sign-in activity, app access and recovery details.

How to Tell If Your Microsoft Account Has Been Compromised

Quick checks to confirm whether someone else has been inside the Microsoft account behind your PC, Xbox and inbox — and how to close every foothold.

How to Recover Your Microsoft Account After Being Hacked

How to get back into a hacked Microsoft account — the sign-in you use for Windows, Xbox, Office and Outlook — and what to do straight after.