Why businesses hit by ransomware should report to the police and PA05

When a NAS, SQL Server database or virtual machine becomes unreadable and a ransom note appears, restoring operations is urgent. The response should also preserve evidence, report suspected criminal activity and assess legal notification duties. These tasks can run in parallel.

This article reviews Vietnamese law against official sources on 25 October 2026. It does not identify an attacker, describe a client incident or replace an organisation's own legal assessment.

1. Encryption, deletion, overwriting and theft are different findings

• Encryption: all or selected parts of a file may have been transformed. Recovery depends on the actual variant, key material and damage, rather than the extension alone.
• Deletion: file records, snapshots or backups may be removed. Remaining content depends on storage behaviour, including TRIM, garbage collection, RAID and subsequent writes.
• Overwriting: original bytes at affected locations have been replaced. Do not promise software recovery of genuinely overwritten content; assess independent copies and other sources.
• Theft: copying or unauthorised access requires its own evidence. Correlate transfer logs, endpoint telemetry, cloud activity and access records. An encrypted file or an extortion claim alone does not prove exfiltration.

Record what was observed separately from what is suspected. Missing logs do not establish that an activity did not occur.

2. PA05 and the authority receiving a crime report

PA05 is a commonly used designation for the provincial police unit specialising in cybersecurity and high-tech crime. It is a relevant professional contact for a suspected ransomware attack. The competent authority determines how a particular report is handled.

Victims do not have to locate a specialist unit before making initial contact. Articles 144–146 of the Criminal Procedure Code distinguish a crime report, receipt of that report and authority to resolve it. Commune-level police can receive a report and forward it with relevant materials to the competent investigating authority. Ask for a record of receipt and contact details for follow-up.

See the official consolidation 172/2026/VBHN-LQ-VPQH of 1 October 2026. Its amendment under Law 11/2026/QH16 is marked effective from 1 March 2027 and is not applied at this review date. A consolidation does not give every provision a new effective date.

The Ministry of Public Security's reporting guidance describes in-person, written, duty-phone, email and other reporting channels, including VNeID where applicable. Use contact details verified through an official police channel.

3. Three distinct reporting and notification tasks

Article 40(1)(c) requires the information-system owner to report cybersecurity incidents to the specialised body of the Ministry of Public Security or Ministry of National Defence. For service providers within Article 41, paragraph 3 also requires immediate emergency response and immediate reporting. Additional procedures can apply to critical systems, regulated sectors and contractual relationships.

There is no single 72-hour deadline covering every ransomware procedure. Article 23(1), Law 91/2025/QH15 applies that deadline, from discovery of the violation, to personal-data controllers, controller-processors and third parties where the violation may harm the national interests or data-subject interests listed in that provision. A processor discovering a violation must promptly inform the controller or controller-processor. Article 23(3) also provides other notification cases.

Do not treat “no evidence of exfiltration” as “no personal-data violation”. Loss, alteration or unlawful processing may also require assessment. Document the data categories, impact, organisational role, discovery time and grounds for the decision without waiting for the entire investigation to finish.

Article 28 of Decree 356/2025/ND-CP specifies notification content and Form 08. Article 29 separately requires controllers or controller-processors to notify affected subjects within 72 hours of discovering a violation involving location or biometric data. Its paragraph 3 provides a route where technical or emergency circumstances prevent notifying everyone on time. Reporting and record-retention duties also apply, including keeping the violation record for at least five years after remediation.

Consult the official texts: Cybersecurity Law 116/2025/QH15, Personal Data Protection Law 91/2025/QH15 and Decree 356/2025/ND-CP. A crime report does not automatically discharge every incident-reporting or data-notification duty.

4. Why early reporting helps

Reporting creates a documented starting point for cooperation, supports preservation instructions and provides an official channel for extortion threats. A receipt does not certify the technical cause, alleged losses or attribution. It also does not guarantee an arrest, a decryption key or a recovery outcome.

Appoint an authorised representative, incident coordinator and technical lead. Keep a decision log covering isolation, access to evidence and recovery actions. Distinguish operational recommendations from lawful directions issued by the competent authority.

5. Containment and preservation in the first hour

Prioritise stopping continuing harm: isolate affected devices and compromised accounts, restrict SMB/NAS, VPN and hypervisor access, and separate backups from the compromised environment. Record each action and its reason. Do not delay urgent containment to prepare paperwork.

• Ransom note and communications: keep original files, paths, names and timestamps. Export emails with full headers and retain chats and wallet addresses as observed. Do not follow attacker links or execute attachments on operational systems.
• File samples: copy representative encrypted files without renaming them. Record the origin of any clean comparison files. Keep suspected executables separate and never upload confidential client data to public analysis services.
• Logs: export native formats such as EVTX, with audit configuration. Preserve VPN, firewall, AD, EDR, NAS, hypervisor, backup and cloud logs before retention expires. Document time zones, clock offsets, collection windows and gaps. Screenshots supplement the originals.
• Access evidence: correlate sessions, IP addresses, accounts, MFA events, service/task creation, unusual commands, backup changes and outbound traffic. A single unfamiliar IP is not sufficient attribution.
• Storage: photograph serial numbers and RAID slot order; record controller configuration, disk state, datastores and VMDK chains. Avoid rebuilds, initialization, filesystem repairs and write mounts on the source. Imaging and write protection require competent handling, especially for physically failing disks.
• Volatile evidence: trained responders may need RAM, process and connection captures before shutdown where safe. Abrupt shutdown loses volatile data, while leaving an encryptor running may increase damage. Document the chosen trade-off.

SHA-256 verifies consistency, not the attacker's identity

On a clean examination machine, hash a collected sample copy without executing it:

Get-FileHash -LiteralPath 'E:\Evidence\README.txt' -Algorithm SHA256

Record its evidence ID, name, byte size, SHA-256, source, collection time, operator, tool version, storage location and each transfer. Compare hashes after copying and transfer. Preserve a restricted master and work on another copy. A live changing file can produce different hashes; document its collection state.

A matching hash alone does not establish lawful collection, completeness or attribution. Articles 99 and 107 of the Criminal Procedure Code address electronic data and collection; procedural evidential assessment belongs to the competent authority. NIST SP 800-86 is a technical reference rather than a substitute for Vietnamese procedure.

6. What to provide initially

Provide the organisation and authorised representative, location, contact details, discovery time, affected systems, observed intrusion/encryption/extortion indicators, operational impact, actions already taken and an evidence inventory. Mark estimates and unresolved questions clearly.

“At approximately … we found files on our server/NAS were unreadable and a ransom demand had appeared. The intrusion route, full scope and possible external copying remain unconfirmed. We have isolated affected systems and preserved available materials, and request receipt and guidance from the competent authority.”

Do not include an entire accounting database, personnel archive or administrator passwords in an initial unverified email. Transfer only authorised, necessary materials through a verified secure channel, recording what was provided and to whom.

7. Reporting and recovery can proceed together

The representative can contact authorities while responders contain the incident and recovery specialists examine a forensic copy or clone. Comply with lawful directions on preservation, sealing, seizure or examination. Recovery schedules depend on the actual technical and procedural constraints.

Recovering readable files does not prove the system is safe. Investigate persistence and the entry point, rotate compromised credentials and keys, validate backup integrity and restore into a clean, segmented environment with application tests and monitoring.

External recovery providers should document their authorised technical scope. The system owner remains responsible for its own reporting and notification duties. Payment does not guarantee decryption or deletion of stolen data and does not complete incident response.

8. Practical questions

Can we report before identifying the ransomware family or finishing forensic analysis?

Yes. Provide preliminary observations and an inventory of materials held. State what remains unknown. You do not need to attribute the attack or finish recovery before contacting the receiving authority.

Must we find the correct PA05 unit before making a report?

No. PA05 is a relevant specialist contact, but commune-level police or a competent investigating authority can be an initial contact. Ask for a receipt and routing guidance; receipt and resolution can involve different authorities.

Does every ransomware incident have a 72-hour notification deadline?

There is no single 72-hour deadline for every procedure. Article 23(1), Law 91/2025/QH15 specifies roles, violations and risks for that deadline. Article 29, Decree 356/2025/ND-CP separately covers location and biometric data. Incident-reporting and immediate-reporting duties require independent assessment.

Must we assess personal-data duties if files are encrypted but theft is unproven?

Yes. Lack of evidence of theft does not establish that no personal-data protection violation occurred. Assess data categories, impact, the organisation’s role and notification conditions. Record and update the assessment as evidence develops.

Can reporting run alongside encrypted-data recovery?

Teams can work in parallel, preferably using copies for technical work. Comply with lawful preservation, sealing, seizure or examination requirements and retain records. Do not promise recovery deadlines before understanding the constraints.

Are a ransom-note screenshot and a SHA-256 hash enough?

They cannot be assumed sufficient for every case. Preserve original files, native logs, device context, times and transfer history where possible. A hash checks consistency; it does not by itself establish lawful origin or the full sequence of events.

Can we erase traces and reuse the old server once files are recovered?

Preserve materials required by the competent authority. Investigate the entry point, persistence and accounts, then restore into a clean and tested environment. Readable data alone does not demonstrate a safe system.