A ransom note on your screen or files that suddenly won't open is one of the most frightening moments in business. What you do in the first hour determines how much damage spreads and how quickly you recover. This guide walks through immediate actions, containment, the pay-vs-recover decision, and what to avoid.
What Is Ransomware?
Ransomware is malicious software that encrypts your files—or locks you out of your systems entirely—and demands payment (usually cryptocurrency) for the decryption key. Modern ransomware often also steals data before encrypting it, then threatens to publish or sell it even if you pay ("double extortion"). Attackers typically gain access through phishing emails, exposed remote access (RDP), unpatched software, or compromised credentials.
Recognizing the Signs
Signs You're Dealing With Ransomware
- Files suddenly have new extensions you don't recognize
- A ransom note (text file, desktop wallpaper, or pop-up) appears
- You can no longer open documents, spreadsheets, or databases
- Systems are unusually slow or shared drives become inaccessible
- Security software alerts about encryption activity or disabled backups
Immediate Actions: The First Hour
Do This First
0–60 minutes
- Disconnect, don't shut down: Unplug the network cable or disable WiFi on affected machines immediately to stop the encryption from spreading. Avoid powering off—shutting down can destroy evidence and sometimes memory-resident decryption keys.
- Isolate shared drives and servers: Disconnect network shares, mapped drives, and backup servers from the network. Ransomware actively hunts for connected storage.
- Alert your IT/security team immediately: Don't try to fix it alone. Escalate to whoever owns your incident response process, or your managed security provider.
- Photograph the ransom note: Take a photo with your phone (don't screenshot from the infected machine) for evidence and for law enforcement.
- Identify what's affected: Quickly determine which systems, servers, and shares show signs of encryption. This scopes the incident.
- Do not pay yet and do not delete anything: Don't interact with the ransom note, don't pay immediately, and don't delete encrypted files or the note itself—you'll need them.
30-Minute Checklist
Containment Steps
Stop the Spread
Hours 1–24
- Segment the network: If you have managed switches, isolate affected VLANs or subnets to prevent lateral movement to unaffected systems.
- Reset credentials broadly: Assume the attacker had access to credentials. Reset passwords for domain admin, service accounts, VPN, and email—starting with the most privileged accounts.
- Preserve evidence: Don't wipe or reimage systems yet. A forensic team will want to examine logs, the ransom note, and sample encrypted files to identify the ransomware family.
- Check for data exfiltration: Review outbound network traffic and logs for large data transfers in the days before the attack was discovered—this affects notification obligations even if you recover files.
- Engage a ransomware-experienced IR firm: If you don't have in-house expertise, bring in specialists who negotiate, investigate, and rebuild ransomware cases regularly.
When to Involve Authorities
Report It—Law Enforcement Can Help
- Report to the FBI's Internet Crime Complaint Center (ic3.gov) as soon as possible—some ransomware families have known decryption tools law enforcement can point you to
- Contact your local FBI field office for active, high-impact incidents
- Notify CISA (cisa.gov) for cyber threats affecting critical infrastructure or widespread ransomware campaigns
- If personal or customer data was likely stolen, involve legal counsel early—there may be state or federal notification deadlines
- Do not assume paying the ransom is illegal, but be aware some ransomware groups are sanctioned entities—your IR firm or legal counsel can advise on OFAC compliance before any payment
Decision Tree: Pay or Recover From Backup?
Do you have clean, tested, offline (or immutable) backups of the affected data?
Yes → Restore from backup. Verify backups are not infected before restoring, rebuild affected systems from a known clean state, and only reconnect to the network after confirming the attacker's access has been removed.
No → Continue below.
Is the encrypted data critical to operations, and is there no other way to reconstruct it (from paper records, source systems, or partial exports)?
Yes → Consult your IR firm, legal counsel, and insurance carrier about negotiation and payment. Never negotiate or pay directly without expert guidance—there is no guarantee attackers will provide a working decryption key.
No → Rebuild systems from scratch, accept the data loss for non-critical files, and focus resources on hardening against future attacks instead of paying.
Has a free decryptor been published for this ransomware family?
Yes → Check "No More Ransom" (nomoreransom.org) and your IR firm's threat intelligence before paying anything.
No → Weigh cost of payment (with no guarantee) against cost of rebuild and lost productivity, guided by your IR firm and insurer.
Why Paying Is Risky
- No guarantee you'll receive a working decryption key
- Attackers may leave backdoors even after "resolving" the incident
- Paying can mark you as a target willing to pay again
- Some payments may violate sanctions laws depending on the group
- Even with decryption, stolen data may still be leaked or sold
Backup Recovery
Restore Systems the Right Way
Restoring Safely
What NOT to Do
Avoid These Mistakes
- Don't pay the ransom without consulting legal counsel, your insurer, and an experienced IR firm
- Don't restart or reimage systems before evidence is preserved—you may need it for insurance, forensics, or law enforcement
- Don't reconnect "cleaned" systems to the network without confirming the attacker's access is fully removed—reinfection within days is common
- Don't try to negotiate with attackers yourself—experienced negotiators know the tactics and can verify decryption capability first
- Don't assume backups are safe just because they exist—verify they weren't encrypted or deleted too
- Don't stay silent—notify employees, customers, and regulators as required once scope is understood
Contact Template
Internal Ransomware Alert (Fill in and Save Now)
- Incident Response Lead: [Name, Phone, Email]
- IT/Security Contact: [Name, Phone, Email]
- Cyber Insurance Carrier & Policy #: [Fill in]
- External IR Firm (24/7 line): [Company, Phone]
- Legal Counsel: [Name, Phone, Email]
- FBI IC3 Report: ic3.gov
Real-World Scenario
A Manufacturer Locked Out on a Friday Afternoon
At 4:45 PM on a Friday, an employee reports they can't open any files on the shared drive. A ransom note appears demanding payment in Bitcoin within 72 hours. IT finds the same extension on dozens of files across three servers.
What They Did Right:
- Immediately disconnected the affected servers and any machine showing encrypted files
- Left the untouched backup server powered off and unplugged
- Called their cyber insurance carrier that evening, who connected them with an approved IR firm within hours
- Confirmed weekly offline backups were unaffected and restored from a backup 36 hours old
- Lost less than two days of data and avoided paying any ransom