What to Do After a Ransomware Attack

01The first moves

1. 01

   Isolate

   Unplug network cables and turn off Wi-Fi on affected devices. Leave them powered on unless a responder says otherwise, because memory holds evidence.

2. 02

   Stop the spread

   Disconnect shared drives and VPN access, and consider taking the internet connection down if encryption is still spreading.

3. 03

   Call for help

   Contact your IT provider, then your cyber insurance carrier. Many policies require the carrier’s approved incident response firm.

4. 04

   Use clean channels

   Assume email and chat may be watched. Coordinate by phone, from devices and accounts outside the affected environment.

02Preserve the evidence

It is tempting to wipe everything and start again. Doing that first destroys the evidence that shows how the attackers got in, what they took and whether they are still inside, and it can complicate an insurance claim.

• Keep the ransom note and photograph affected screens
• Save firewall, VPN, Microsoft 365 and endpoint logs before they roll over
• Write a timeline: who noticed what, and when
• Hold off on cleanup tools until responders have collected what they need

03Find the way in, then recover

Most ransomware cases trace back to a small set of entry points: a phished password without MFA, an unpatched firewall or VPN, remote desktop exposed to the internet, or a compromised vendor account. Restoring before that door is closed invites a second attack.

Recovery then follows a set order. Clean or rebuild the identity system and reset every password from a clean device. Restore the most critical systems first, from backups the attackers could not reach, and scan them before they rejoin the network.

04Should you pay the ransom?

The FBI and CISA advise against paying. Payment does not assure a working decryption key or that stolen data is deleted, it funds further attacks and it can mark a business as a willing target. Some payments can also raise sanctions issues.

If payment is ever considered, it is a business and legal decision made with your insurer, counsel and an experienced response firm, and never by contacting the attackers yourself.

05Report it

Report ransomware to CISA at cisa.gov/report, or to the FBI through ic3.gov or a local field office. Reports help law enforcement track the groups involved and occasionally recover decryption keys. Depending on your industry and the data involved, you may also have duties to notify clients or regulators, which is a question for counsel.

06How we help

Prevention and recovery are designed together. Endpoint MDR Plan I runs on every managed workstation and server, and Plan II adds fully managed MDR with 24/7 protection, managed application control and cloud response. The backup and disaster recovery add-on provides air-gapped or offline copies, a defined RTO and failover testing, so a restore is a rehearsed process rather than an experiment.

How managed cybersecurity works