It usually starts quietly: files that will not open, a strange file extension, a ransom note on a server desktop. From that moment, every minute counts. The decisions you make in the first hour decide whether you lose a few machines or the whole company’s data.
This guide gives you a practical order of actions. It is written for business owners and IT managers, not only for specialists. Print it, share it with whoever handles IT in your company, and agree on it before something happens.
Minutes 0–10: stop the spread
- Isolate affected devices from the network. Unplug the network cable and turn off Wi-Fi. Do not wipe or reinstall anything yet.
- Do not shut down servers in a panic. Powering off can destroy evidence that sits in memory. If you can, isolate first and ask a specialist whether to power off.
- Disconnect shared resources. Cut access to file shares, VPN and remote desktop. Ransomware spreads through whatever is reachable.
- Protect your backups. If backups are on the same network, disconnect that storage now. Attackers often look for backups first.
Minutes 10–30: understand what happened
- Write down the time you noticed the problem, which machines are affected and what the ransom note says. Take photos or screenshots.
- Change critical passwords from a clean device, not from an infected one: administrator accounts, email, VPN, cloud consoles. Turn on multi-factor authentication wherever it is missing.
- Check which accounts logged in recently. Look for unknown users, new administrator accounts and logins at odd hours.
- Do not contact the attackers yet and do not pay under pressure. A payment does not guarantee that data is returned, and it marks your company as a willing payer.
Minutes 30–60: call the right people
- Bring in incident response help. An experienced team can confirm the type of ransomware, how the attackers got in and whether data was stolen, not only encrypted.
- Inform management and decide who speaks for the company. One person should handle all communication with staff, clients and partners.
- Consider legal duties. If personal data may have been exposed, data protection rules can require notifying the authority within a short deadline, often 72 hours. Ask a lawyer to confirm which rules apply to you.
- Report the incident to the relevant national authority or CERT, and to the police if you intend to file a complaint.
Important: restoring from backup is only safe once you know how the attackers got in. If you restore into the same weakness, you can be hit again within days.
After the first hour: recovery
Recovery is a project, not a button. A sensible order is:
- Rebuild or clean affected systems from trusted media.
- Close the entry point: unpatched software, exposed remote access, stolen credentials or a phishing email.
- Restore data from a backup that you have verified is clean, starting with the systems the business needs most.
- Monitor closely for several weeks for any sign that the attackers are still inside.
How to be ready before an attack
Most of the pain in a ransomware incident comes from not being prepared. These measures make the biggest difference:
- Backups that cannot be encrypted. Keep at least one copy offline or immutable, and follow the 3-2-1 rule: three copies, two types of media, one off-site.
- Tested restores. A backup you have never restored is only a hope. Schedule restore tests and measure how long they take. We explain the targets in our article on recovery objectives (RTO and RPO).
- Patching and least privilege. Keep systems updated and give people only the access they need.
- Multi-factor authentication on email, VPN and administrator accounts.
- A written incident plan with phone numbers, roles and the order of steps above.
- Staff awareness. Most attacks start with one convincing email. Short, regular training pays off.
How we can help
Alficom designs business continuity and disaster recovery solutions with local and cloud replication and immutable backups, and helps you build a cyber resilience strategy with an incident response plan. If you want to know where you stand today, we can start with a short review of your backups and your exposure to this kind of attack.
