Ransomware Incident: What to Do First

If you are reading this during an incident, take a breath and work through the list in order. Ransomware is stressful because it is visible and loud, but good outcomes often come from calm, deliberate action rather than speed alone.

Contain promptly

Disconnect affected machines from the network: unplug the cable, disable Wi-Fi, or isolate them with your endpoint tool. Powering a system off can destroy useful evidence held in memory, so isolation is often preferable to shutdown, though a quick decision matters more than a perfect one. Block suspicious accounts and, if you cannot tell what is affected, consider cutting off remote access and internet-facing services while you assess.

Preserve evidence in parallel

Containment and evidence capture run side by side, and evidence is not a reason to wait on containment. Do not wipe, reimage or delete anything yet. Photograph or save the ransom note, keep affected disks and virtual machine snapshots, and record what you did and when. A written timeline of actions, with names and times, is valuable later.

Protect your backups

Attackers commonly look for backups and try to delete or encrypt them. Check right away whether you have copies that are offline or immutable, and keep backup consoles and credentials away from affected machines. Do not connect restore media to a network until you know it is clean.

Reset access and revoke sessions

Assume credentials on affected systems are exposed. Reset passwords for privileged, service and administrator accounts, using a clean device. Revoke active sessions and tokens in cloud services such as Microsoft 365, and review recent sign-ins, mailbox rules, forwarding and application consents. Multi-factor authentication helps but does not fix a stolen session by itself.

Assume data may have left

Ransomware operators often steal data before they encrypt it. Ask your responders to look for signs of large transfers, new remote-access tools and cloud-sync activity. This affects who you need to inform, so treat it as part of the investigation from the start.

Decide who decides

Name one incident lead. Bring in your cyber insurer, outside counsel and an incident response firm early. They can advise on notification questions and on whether to engage the threat actor. Whether to pay is a business decision made with advice, not a first-hour reflex, and payment does not ensure you get usable data back.

Communicate carefully

Use a channel the attacker is unlikely to read, such as a phone bridge or a clean, separate chat, because email and chat may be monitored. Give staff short, factual instructions, such as what to shut down and what to leave alone. Hold public statements until counsel has reviewed them.

Recover from a known-good state

Rebuild affected systems from trusted media rather than cleaning them in place. Restore the most important services first, test each restore, and watch closely for signs the attacker is still present. Close the way in: patch the entry point, remove persistence and rotate remaining secrets before reconnecting.

Mistakes that make it worse

• Rebooting or reimaging first and asking questions later, which can erase the only record of how the attacker got in.
• Restoring from backup before the entry point is closed, so the attacker simply returns.
• Resetting only one account when several were exposed.
• Telling no one outside IT until the situation is public.
• Reusing the same administrator credentials on the rebuilt systems.

Learn from it

Once things are stable, review what happened. How did the attacker get in? What slowed detection? Were backups restorable, and did people know their roles? Turn the answers into specific fixes with owners and dates.

The best time to rehearse this is before you need it. A short tabletop exercise exposes gaps in contacts, backups and decision rights while the stakes are low.

Message us to talk through your ransomware response plan.