The first hour after ransomware is discovered shapes everything that follows. Calm, structured action limits the damage.
Do
- Isolate affected devices from the network by disconnecting cables and Wi-Fi. Do not switch them off unless advised, as evidence may be lost.
- Alert your IT lead and management immediately using a channel that does not depend on affected systems.
- Protect backups by disconnecting or locking down backup systems if they are reachable from the network.
- Start a log of what was seen, when and by whom.
- Contact your insurer if you have cyber cover, as many policies require early notification and provide response support.
Don’t
- Don’t delete files or run random cleanup tools.
- Don’t contact the attackers without professional advice.
- Don’t restore from backups until you know how the attackers got in.
After the First Hour
Identify the entry point, assess what data may be affected and consider legal obligations, including data protection notifications where personal data is involved.
Prepare Now
A one page incident plan with contacts and first steps makes this hour far less chaotic.
Get in touch to prepare an incident response plan.