Ransomware encrypts your files and demands payment for the key, and increasingly it also steals data and threatens to publish it. If it happens to you, panic is natural, but the decisions made in the first hours matter most. Keep this list somewhere you can reach it even if your systems are down.
1. Contain it immediately
Disconnect affected computers from the network — unplug the cable and turn off Wi-Fi — but do not wipe or rebuild them yet. If you can, also disconnect shared drives and stop file syncing so the encryption cannot spread further.
2. Call your IT provider or incident responder
Bring in experienced help straight away. They will work out what was hit, how the attackers got in, and whether they still have access.
3. Preserve evidence
Photograph ransom notes and note the time you first noticed the problem. Keep affected machines intact for investigation. Logs and evidence decide what happened, what data was taken, and what you may need to report.
4. Check your backups before touching them
Confirm your backups are intact and were not reached by the attackers. Restore only onto clean, rebuilt systems — restoring onto infected machines simply starts the attack again.
5. Lock down accounts
From a clean device, reset passwords for administrator accounts, email, and remote access, revoke active sessions, and make sure multi-factor authentication is on. Attackers often wait inside compromised accounts.
6. Make the right calls
- Your cyber insurance provider, if you have one — many policies require early notice and have incident response teams on call.
- Law enforcement: in the US, report to the FBI through ic3.gov; in Jamaica, contact the police.
- Legal counsel, to decide whether customers or regulators must be notified under Florida, Jamaican, or other laws that apply to you.
7. Be very careful about paying
Paying does not guarantee your data back or that stolen data will be deleted, and it can carry legal risks of its own. Make that decision only with your incident responder, insurer, and lawyer.
Prevention costs far less
Multi-factor authentication, prompt patching, endpoint detection and response, email filtering, staff training, and tested backups that ransomware cannot reach stop most attacks or make them recoverable.
We help businesses prepare for — and recover from — ransomware. If you would like your defences and backups reviewed before you ever need this list, ask us for a free security assessment.
Related service: IT Solutions — Managed IT, backups, disaster recovery, and security.