Security guide
Suspected Ransomware: What a Business Should Do in the First Hour
The decisions made in the first hour of a ransomware incident largely determine how long recovery takes and how much data is lost. The priority is to stop the spread without destroying the information investigators and insurers will need. This guide summarizes the immediate steps; it is not a substitute for an incident response plan or professional assistance.
Step-by-step
Isolate affected systems immediately
Disconnect affected computers and servers from the network: unplug the network cable and turn off Wi-Fi. If several systems or an entire segment appear affected, disconnect at the switch. Isolation is preferred over shutting down, because powering off destroys evidence held in memory. Shut down only if a device cannot be disconnected.
Use out-of-band communication
Assume attackers may be able to read company email or chat. Coordinate the response by phone and agree on a separate channel for updates until the environment is confirmed clean.
Protect your backups
Disconnect backup systems and storage from the network and suspend backup jobs, so encrypted data doesn't overwrite good copies. Confirm whether offline or immutable backups exist and whether they are intact. Do not begin restoring until the attacker's access is removed.
Bring in help and notify your insurer
Contact your IT provider or incident response firm. If you have cyber insurance, notify the insurer early. Many policies require you to use approved responders, and acting without them can affect cover.
Preserve evidence
Don't wipe or reimage machines yet. Photograph ransom notes, record which systems are affected and when the problem was first noticed, and keep logs from firewalls, servers and security tools. Responders use these to determine how the attacker got in.
Report the incident
In the United States, report to CISA, the FBI's Internet Crime Complaint Center (IC3) or your local FBI field office. Authorities may have information about the specific variant, including available decryption tools. If personal data may have been accessed, take advice on your breach notification obligations.
Don't contact or pay the attackers without advice
Payment doesn't guarantee recovery and may carry legal implications. Any decision of that kind should involve legal counsel, your insurer and law enforcement.
After containment
Recovery involves identifying how the attackers got in, removing their access and any persistence they left behind, resetting credentials from clean devices, and restoring systems in priority order from known-good backups. Close the original entry point before reconnecting anything.
Prepare before it happens
Keep a printed incident contact list, maintain offline or immutable backups that are tested regularly, enforce multi-factor authentication, and agree in advance who decides what during an incident.