Ransomware Response: Immediate Steps for Businesses

1. Isolate affected devices and systems where appropriate — unplug network cables, turn off Wi-Fi or disable the network adapter — so encryption cannot reach more machines.
2. Avoid unnecessary interaction with compromised systems. Do not open encrypted files, run cleanup tools or log in repeatedly. Avoid powering devices off where evidence may matter; information held only in memory can be lost. Shut down only if it is the only way to stop active, visible damage.
3. Protect what is not yet affected — especially backups, shared storage and administrator accounts (see below).
4. Notify your internal IT or security contact, or your outsourced IT provider or MSP, with a short factual description of what was seen and when.
5. Start documenting immediately: a written timeline of what was noticed, by whom, and every action taken since.
6. Contact your cyber insurer early if you have cover — many policies require prompt notice and specify approved incident-response providers.

Signs it may be ransomware

• Files renamed with an unfamiliar extension, or that suddenly will not open.
• A ransom note as a text file, changed desktop wallpaper or pop-up window.
• Shared drives, backups or network folders becoming inaccessible at once.
• Security software disabled or reporting tampering.
• Several devices affected within a short window.

Ransomware often moves across a network using shared drives, remote-access tools and reused administrator credentials. Containment is about cutting those paths without destroying the record of what happened.

• Disconnect affected devices from the network, and consider temporarily disconnecting shared storage that infected machines could reach.
• Check other devices, servers and shared folders for the same signs, so you know how far it has already spread.
• Ask your IT provider to review remote-access paths such as VPN, remote desktop and remote-management tools, and to suspend any that are not essential right now.
• Pause file-sync clients on unaffected devices if synced folders may be carrying encrypted files to the cloud.

Evidence helps your insurer, IT provider or a specialist responder understand how the attack started and whether data was taken. Indiscriminate deletion, wiping or reinstallation can destroy that record permanently. Keep:

• Screenshots of the ransom note and any on-screen messages.
• The ransom note file itself, unopened beyond what you have already seen.
• Suspicious emails or attachments that may have started the incident.
• Relevant logs: security software alerts, firewall, VPN and sign-in logs.
• Examples of encrypted filenames and the new file extension.
• Timestamps of when each device was noticed or isolated.
• Affected-device information: device name, user, location and role.
• A running timeline of events and decisions, and who made them.

Attackers frequently collect passwords before encrypting anything, so assume credentials used on affected devices may be known to them.

• Change passwords for administrator, email, finance and backup accounts — from a device you know is clean, not from an affected machine.
• Make sure multi-factor authentication is on for email, cloud and remote-access accounts, and review recently added accounts or sign-in methods.
• Disconnect backup drives or pause backup jobs if the backup destination could be reached from an infected device.
• Keep unaffected systems off any network segment where infected devices are still connected.

If an email account was used to deliver the attack, our guide to a hacked email account covers removing attacker access to the mailbox.

Work through each area and note what you know, what you suspect and what is unchecked:

• Endpoints — laptops and desktops showing encrypted files or alerts.
• Servers — file, application, database and domain servers.
• Shared storage — network drives, NAS devices and shared folders.
• Cloud systems — synced storage, cloud file shares and SaaS tools reachable with affected credentials.
• Backups — whether they were connected at the time and when the last known-good copy was taken.
• Email and accounts — any mailbox or admin account used on affected devices.
• Sensitive information — which affected systems held personal, financial or commercially sensitive data.

Many ransomware incidents also involve data being copied out before encryption. That means restoring from backup does not automatically end the incident: you may still need to establish whether personal or confidential information was accessed or exfiltrated.

• Look for unusual outbound transfers in network or firewall logs before detection.
• Note whether the ransom note or attacker messages reference specific files or data.
• Treat exfiltration as possible rather than ruled out without specific evidence.

Whether any notification is required depends on the data involved, the risk to people and the rules where you operate. Our data breach response guide explains how to assess affected data and document it. It is guidance, not a legal determination.

• Validate backups before relying on them — check their date, and where possible test-restore a sample in an isolated environment.
• Choose a clean recovery point that predates the initial compromise, not just the encryption. Attackers are often present for days beforehand.
• Rebuild or restore in a controlled order, starting with the systems the business needs most, and only reconnect once the entry point is understood.
• Change compromised credentials where appropriate, including service and administrator accounts, before restored systems go back online.
• Document the recovery: what was restored, from which backup, by whom and when.
• Monitor after restoration for repeat alerts, unusual sign-ins or renewed encryption activity.

On paying a ransom

Whether to pay is a business and legal decision that depends on advice from your insurer and legal counsel and, in some jurisdictions, sanctions or regulatory rules. Cyber Crisis Desk does not advise on it and focuses on containment, evidence and recovery regardless.

• Do not delete evidence prematurely — including ransom notes, logs or emails.
• Do not immediately wipe or reinstall systems before you understand the incident, unless it is required to stop ongoing damage.
• Do not assume backups are unaffected until they have been checked.
• Do not reconnect compromised systems or backups to the network too early.
• Do not assume ransomware only encrypted files — data may also have been copied out.
• Do not run "decryptor" tools of unknown origin; some are themselves malicious.
• Do not attempt to trace or access the attacker's systems. Cyber Crisis Desk is strictly defensive.

1. Affected devices disconnected from the network.
2. IT contact or provider informed, with a factual summary.
3. Backups disconnected or paused, and their status recorded.
4. Ransom note, screenshots and suspicious emails preserved.
5. Timeline started: discovery time, actions and decision-makers.
6. Passwords changed for admin, email, finance and backup accounts from a clean device.
7. Scope listed: endpoints, servers, shared storage, cloud, backups, accounts.
8. Possible data theft assessed, not assumed away.
9. Insurer contacted; legal advice sought where personal data or payment is involved.
10. Recovery point validated before restoring; monitoring planned afterwards.

• Your cyber insurer — as early as possible, as policies often set notification windows.
• Your data-protection regulator — may need to be considered if personal data was likely accessed; in the UK that is the ICO. Requirements depend on the circumstances.
• Legal counsel — on notification, contractual and sanctions questions.
• National reporting channels — for example Action Fraud and the NCSC in the UK, or the equivalent body where you operate.

Cyber Crisis Desk is not a law-enforcement, legal or forensic service. It does not report on your behalf or negotiate with attackers; it helps you organise the facts you need to make those calls with proper advice.

A free emergency check asks a few questions about what is affected, whether it is spreading and whether backups are available. From that, the platform selects a ransomware playbook and builds an Immediate Rescue Plan grouped by urgency.

• Client Next Action gives you one clear step at a time.
• Evidence requests say exactly what to capture before systems are rebuilt, stored in your private case.
• Recovery tracks record which devices are isolated, which backups are verified and what has been restored.
• Structured reports assemble the timeline and evidence for your insurer, legal counsel or regulator.

If you are a smaller organisation without a security team, see our cyber incident response guide for small businesses, or read how the guided workflow fits together and compare the plans and the one-time Emergency Pass.

• We do not decrypt files, negotiate with attackers or decide whether to pay.
• We do not perform deep forensic analysis or malware reverse engineering, and we do not guarantee any outcome.
• This is guided response, not a substitute for a qualified incident-response specialist, insurer or legal counsel where the incident is severe or regulated.
• We do not provide legal advice or make legal determinations for you.

Should I turn everything off straight away?

Disconnect affected devices from the network first. Powering them off can lose evidence held in memory, so seek advice before a full shutdown unless it is the only way to stop active, visible damage.

Can Cyber Crisis Desk decrypt my files?

No. We do not provide decryption tools or negotiate with attackers. We help you contain the incident, protect and verify backups, and organise evidence for your insurer, legal counsel or a specialist responder.

My backup looks fine — do I still need to check anything?

Yes. Confirm the backup predates the initial compromise and, where possible, test-restore a sample in an isolated environment. Backups connected to the network at the time may also be affected.

Do I have to tell anyone if I restore from backup and never pay?

Possibly. If data may have been accessed or copied before encryption, notification may still need to be considered regardless of payment or a successful restore. Check with your regulator's guidance and legal counsel.