Ransomware: What to Do in the First Hour

What you do in the first hour after finding ransomware decides how much can be saved. Work through this list, then call us.

1. Isolate

• Unplug network cables and turn off Wi-Fi on affected computers and servers
• Disconnect backup drives and NAS units from the network
• If the encryption is still spreading, shut down the affected machines rather than wait
• Keep the internet connection to unaffected machines you need for communication, or use phones

2. Preserve

• Don’t delete encrypted files, ransom notes, or anything with a strange extension
• Don’t wipe, reinstall or “restore to factory settings”
• Photograph ransom notes and any messages on screen
• Keep firewall, server and antivirus logs: they show how the attackers got in

3. Protect what’s left

• Change passwords for email, banking and admin accounts from a clean device
• Check that your offsite or cloud backups are intact, but don’t restore yet
• Turn off any scheduled backup jobs that might overwrite good backups with encrypted files

4. Get help and report it

• Call us. We tell you what can be recovered and how fast
• Tell your cyber insurer straight away, before spending money: many policies require it
• Report the attack to the FBI at ic3.gov. The FBI and CISA collect reports to help victims
• Speak to a lawyer about notification duties if personal data may have been taken. California has its own breach notification law