What to Do After a Ransomware Attack: A Checklist for Small Businesses
If your files are locked and a ransom note is on the screen, the first hour matters. This checklist covers what to do, what not to do, and how to recover. Call your IT provider first if you have one.
The first hour
- Disconnect, do not shut down. Unplug the network cable and turn off Wi-Fi on affected computers. Leave them powered on if you can, since memory can hold clues. Disconnect any server or backup drive that may be reachable.
- Call your IT provider. Tell them what you see on screen and when it started.
- Do not reply to the attacker. Do not pay or negotiate yet.
- Isolate backups. Make sure nobody connects an external backup drive to an affected computer.
- Write down what happened. Which machines, which files, the ransom note text, and the time each person noticed.
Who to notify
Contact your cyber insurance carrier early, since many policies require quick notice and have approved response vendors. Talk to your attorney about notification duties, especially if client, patient or employee data may be involved. Healthcare practices have additional obligations under HIPAA, which your attorney or compliance advisor should interpret. You may also report the incident to law enforcement, such as the FBI’s Internet Crime Complaint Center (IC3).
Should you pay the ransom?
Law enforcement generally discourages paying. Payment does not guarantee you will get your data back, may encourage more attacks, and can raise legal questions. The decision belongs to you with advice from your attorney and insurer. The best protection against having to decide is a backup the attacker could not touch.
Recovering
- Find how they got in. Common causes are phishing emails, stolen passwords without multi-factor authentication, exposed remote desktop and unpatched software. If you skip this step, the attacker can return.
- Rebuild from clean systems. Affected computers are usually wiped and rebuilt, and data is restored from a clean backup.
- Change passwords. Reset credentials, starting with administrators, email and anything stored on affected machines.
- Check the backups. Confirm they are intact and from before the attack.
- Bring systems back in order. Servers and critical applications first, then workstations.
How to make the next attack a non-event
The same layers that protect you also shorten recovery: endpoint protection and tested, off-site backups, email filtering and phishing training, multi-factor authentication, and prompt patching. Our backup and disaster recovery service keeps copies that an attacker on your network cannot encrypt, and we test restores so you know how long recovery takes.
Need help now?
If you are in the middle of an incident, call us at (281) 767-9070. We support businesses across greater Houston. We cannot promise every case ends the same way, which is why prevention and tested backups come first.
Common questions
Should I turn off my computer after a ransomware attack?
Disconnect it from the network and Wi-Fi first. Leaving it powered on can preserve information that helps investigators, but follow your IT provider's instructions.
Can ransomware spread to backups?
Yes, if the backup is connected to the network or reachable with the same credentials. Off-site and immutable backups protect against this.
How long does ransomware recovery take?
It depends on how many systems are affected and the state of your backups. With tested backups it can be days, without them it can be weeks or impossible.
Does cyber insurance cover ransomware?
Some policies do, with conditions. Review your policy and call your agent early.
Talk to a local IT team
Get a free IT assessment and a written plan for your business.
Let’s see where your IT stands.
A free, no-pressure assessment of your network, security, backups and Microsoft 365, with a clear written plan.