What to do in the first hour after ransomware

Someone calls out that their files have strange new names. A note on the screen says your data has been encrypted and demands payment. Other computers start showing the same thing. It is a frightening moment, and the instinct is to do something, anything, right away.

The steps you take in the first hour matter a great deal. Good decisions limit the damage and keep recovery options open. Rushed ones can destroy evidence, spread the infection or wipe out the backups you need.

1. Isolate affected devices

Your first job is to stop the spread.

1. Disconnect affected computers from the network. Unplug the network cable and turn off Wi-Fi.
2. Do not shut them down or wipe them yet unless your IT or security team tells you to. Some evidence only exists while the machine is running.
3. If many machines are affected, or you are not sure, disconnect the office internet connection or unplug the main network switch.
4. Disconnect any USB or external backup drives that are still attached, and leave them unplugged.
5. Stop any sync tools from running on affected machines if you can do so safely.

2. Do not pay, at least not yet

The ransom note is designed to create panic, often with a countdown. Do not contact the attackers, click links in the note or make any payment in the first hour.

Paying does not guarantee you will get your data back, and it may not stop stolen data from being published. Payments can also carry legal and regulatory risks. Any decision about paying should only be made later, with your insurer, legal counsel and incident response team involved, and once you know whether your backups can restore your systems.

3. Call the right people

Use phones or personal devices to communicate. Assume company email and chat may be watched by the attacker.

• Your IT provider or security team. They can confirm what is affected and start containment.
• Your cyber insurance carrier. Many policies require prompt notice and may require you to use their approved incident response firms. Calling early helps protect your coverage.
• Legal counsel. A lawyer can advise on your obligations, including whether you need to notify customers, employees or regulators. We cannot give legal advice, so involve counsel early.
• Law enforcement. Report the attack to the FBI through the Internet Crime Complaint Center at ic3.gov, and consider contacting your local FBI field office. Reporting can help investigators and sometimes provides useful information about the attackers.

4. Preserve evidence

It is tempting to start cleaning up right away. Hold off until the response team says it is safe.

• Photograph the ransom note and any error messages with a phone.
• Write down when the problem was first noticed, by whom, and which devices showed symptoms.
• Do not delete files, reinstall Windows or restore from backup over affected machines yet.
• Keep firewall, server and security logs. Ask your IT provider to export them before they roll over.
• Keep a simple timeline of every action taken and who took it.

This information helps investigators find out how the attackers got in and whether data was stolen. It may also be needed for insurance claims and any notifications.

5. Protect your backups and accounts

1. Confirm your backups are disconnected from the affected network and check whether they are intact. Immutable or offsite copies are especially important now.
2. Change passwords for administrator accounts, backup consoles and key cloud services from a clean device.
3. Review Microsoft 365 for unusual sign-ins, new mail forwarding rules and new admin accounts. Attackers often steal account access as well. Our post on MFA fatigue and token theft explains what to look for.
4. Do not reconnect anything to the network until the response team agrees it is clean.

6. Keep the business talking

Pick one person to coordinate. Tell staff what is happening in simple terms, ask them not to discuss it on social media, and tell them what to do in the meantime. Prepare a short holding statement for customers in case they ask, and have counsel review anything that goes outside the company.

After the first hour

Recovery takes days, not hours. Once the attackers are removed, systems are restored from clean backups in priority order, and security gaps are closed so it does not happen again. Writing this checklist into a plan before an attack, with names and phone numbers, is the single best way to make that first hour calmer.

Getting help

If you think ransomware is active on your network right now, disconnect affected devices and call us. Creative IT USA provides cybersecurity services and backup and disaster recovery for businesses across Los Angeles County, the Inland Empire and Ventura County.