Ransomware

Most ransom messages on iPhone and iPad are scams. If you get a message in your browser, or an SMS or iMessage that your iPhone has been disabled or data has been encrypted, likely it is a scam. Do not pay, clear all browser data or delete the message, and report it to Apple.

If not a scam, it is installed as an unremovable management profile from the Internet, sideloaded from an infected computer, or downloaded as the result of jailbreaking the device. Unless your device is jailbroken or using an outdated version of iOS, the most ransomware can do is hide your apps or control settings on your device, not encrypt your data. You will be able to restore your device from backup.

Detecting

  1. If many of your apps are missing from your home screen, you may have ransomware on your iOS device.

  2. Go to Settings -> General -> Profiles and Device Management and look for unknown management profiles.

  3. If your device (phone or pad) is infected, there will be some notification from an app that demands payment. These pop-ups may appear out of the blue, or they may occur when doing a specific action (like pressing the Home button).

  4. Try searching for the message you see in a search engine to find out more.

  5. Do not pay to get your data back. Even if you pay, there is no guarantee the ransomware will be removed. Try to remove it. If you can not, get help.

Removing

  1. Attempt to remove the found culprit management profile. Go to Settings -> General -> Profiles and Device Management, then tap on the management profile to remove. Tap on Remove Profile at the bottom of the screen, then enter your passcode.

  2. Backup the device.

  3. Power down the device (hard reset).

  4. While powered down, connect the device to your workstation.

  5. Put it in DFU mode.

  6. Choose Restore Device to reinstall iOS.

  7. Restore data from backup. Some apps may need to be reinstalled too.

Preventing

  1. Only install apps from the App Store. Read app reviews.

  2. Back up iPhone or iPad often. If your device does get infected, you can restore your data right away.

  3. Always use the latest iOS version.