Ransomware attack? Do this first.

Signs it's ransomware

• Files won't open, or their names now end in an odd extension.
• A note on screen or in every folder demanding payment, usually in cryptocurrency.
• Shared drives, servers or cloud folders filling up with renamed files.
• Antivirus suddenly switched off, or backups failing or missing.

Do this in the first hour

1. Disconnect, don't switch off. Unplug the network cable and turn off Wi-Fi on affected computers, but leave them powered on. What's in memory can show how the attacker got in.
2. Protect your backups. Disconnect any backup drive or appliance that's still attached, and pause any sync to cloud storage so encrypted files don't overwrite good copies.
3. Take a photo of the ransom note and any messages on screen. Don't reply to the attackers or click their links.
4. From a clean device, change passwords for admin accounts, email and remote access, and check multi-factor authentication is on.
5. If you have cyber insurance, call their incident line now. Most policies expect prompt notice and some have their own process.
6. Don't wipe or rebuild anything yet. Restoring before you know how they got in is how the same attack happens again next week.

Then call me on 03333 401 999. Treat it as an emergency: in most cases I can start working on it remotely within the hour.

Should you pay the ransom?

That's your decision, but go in with your eyes open. Paying doesn't guarantee you'll get working files back, the decryption tools are often slow and broken, and paying marks you as someone who pays. Modern ransomware groups usually copy your data before encrypting it, so paying for a key doesn't stop them publishing or selling what they took.

Paying can also break the law if the group is subject to UK sanctions, and the government has announced plans to ban payments by public sector bodies. The National Cyber Security Centre and the police don't encourage payment. Talk to your insurer and get advice before anyone opens a conversation with the attackers.

Recovering safely

Getting back to work is the priority, but in the right order:

1. Find the way in. A phished password, an unpatched remote access system or a stolen admin account. Close it first.
2. Check the backups are clean and from before the attacker arrived, which is often days or weeks before the encryption.
3. Rebuild, then restore, starting with the systems the business can't run without.
4. Reset every password the attacker could have seen, not just the obvious ones.

Who you need to tell

Most ransomware groups take data as well as locking it, so treat it as a possible data breach. If personal data was exposed and it's likely to put people at risk, it needs reporting to the ICO within 72 hours of you becoming aware of it.

Report the crime to Report Fraud on 0300 123 2040 (England, Wales and Northern Ireland), or to Police Scotland on 101. Your insurer, bank and key customers may need to hear from you too. I'll help you work out who, and what to say.

How I help

My incident response starts with a fixed-fee first response of £795: contain the attack, protect what's left, and a preliminary investigation so you know where you stand. I'm usually working on it remotely within the hour, and on site the same day when that helps. After that you get a fixed quote for anything more, such as a full investigation, recovery or reporting. Nothing goes ahead until you've agreed it, and I'll work alongside your IT provider and insurer.

Ransomware often starts with a single stolen password. Read what to do if your business email is hacked, and when the dust settles, Cyber Essentials covers the controls that stop most of these attacks.