You arrive at work and files won’t open. Names have changed to strange extensions, and there’s a note on the screen demanding payment. It’s ransomware. What you do in the next hour has a big effect on how much you lose and how quickly you recover. This is a calm checklist for that moment. Keep a printed copy somewhere other than your computer.

First: what not to do

  • Don’t switch everything off at the wall. Evidence held in memory can help investigators, and an unplanned shutdown can damage files that are mid-encryption. Disconnect from the network instead (see below), unless your IT provider tells you otherwise.
  • Don’t contact the criminals or pay. Not yet, and preferably not at all.
  • Don’t start deleting or restoring files. Restoring onto infected systems can re-infect clean backups.
  • Don’t use your normal email to discuss the attack. Assume the attackers may be reading it. Use phones.

The first hour, step by step

1. Isolate affected devices (minutes 0–10)

Unplug network cables from affected computers and turn off their Wi-Fi. If you can, disconnect the internet connection at the router so the infection can’t spread or keep talking to the attackers. If you use managed endpoint protection with response capability, your provider may be able to isolate devices remotely in seconds.

2. Call your IT provider (minutes 5–15)

Tell them what you can see: which computers are affected, what the ransom note says and roughly when it started. Take photos of the screens. If you don’t have an IT provider, call one that handles incident response. We can help businesses across Kent on 01843 482 279.

3. Protect your backups (minutes 10–20)

Disconnect any backup drive or NAS that is plugged into the network. Ask your provider to check that cloud and offsite backups are intact and that their passwords haven’t been changed. Your backups are your way out, and attackers deliberately target them.

4. Secure accounts (minutes 15–30)

From a device you know is clean, change the passwords on administrator accounts and Microsoft 365, sign out all sessions, and confirm MFA is switched on. Check for new admin accounts or email forwarding rules you didn’t create.

5. Tell the right people (minutes 20–45)

  • Your cyber insurer, if you have a policy. Many have a 24-hour incident line and require prompt notification.
  • Action Fraud, the UK’s national reporting centre for fraud and cybercrime.
  • The ICO, if personal data may have been accessed, lost or made unavailable. Personal data breaches that pose a risk to people must be reported within 72 hours of becoming aware of them.
  • Your bank, if any payment systems may be affected.

6. Keep the business running (minutes 30–60)

Decide what staff should do while systems are down. Divert phones to mobiles, use Microsoft 365 on clean phones if it’s unaffected, and keep a simple written log of what happened and when. You’ll need it for your insurer and any report.

Should you pay the ransom?

The National Cyber Security Centre and law enforcement advise against paying. There’s no guarantee you’ll get working files back, you may be targeted again, and the money funds further crime. Recovery from clean, offsite backups is the safer route, which is why tested backups matter so much.

Recovering

Recovery usually follows this order: confirm how the attackers got in and close that route; wipe and rebuild affected devices; restore data from the last clean backup; then reset all credentials. Our data recovery service handles this for businesses that aren’t clients too.

Prepare now: a one-page incident plan

The first hour goes far better when it’s been thought about in advance. Write a single page and keep printed copies away from the office computers:

  • Your IT provider’s emergency number, and who is allowed to call it.
  • Your cyber insurer’s incident line and policy number.
  • Your bank’s fraud line.
  • Where your backups are, and who can confirm they’re intact.
  • Staff contact numbers that don’t depend on email.
  • How you’ll keep trading: phones diverted to mobiles, a paper process for orders or bookings.

Our business continuity service builds this plan with you and tests it.

Make the next hour unnecessary

Most ransomware gets in through stolen passwords, phishing emails or unpatched systems. Multi-factor authentication, managed updates, endpoint protection with MDR and tested offsite backups stop most attacks, and make the rest recoverable. Book a free security review to find your gaps before an attacker does.