Ransomware: what to do in the first hour

If you are reading this because ransomware has just hit your business, take a breath. The first hour is about stopping it spreading, getting the right people involved and not destroying anything you will need later. It is not about fixing everything. Work through the steps below in order.

If you are reading this before anything has happened, even better. Print it, fill in the blanks at the end and keep a copy somewhere that does not depend on your network.

How you will probably notice

Ransomware rarely announces itself politely. Common first signs include:

• Files that will not open, or that suddenly have a strange extension.
• A text file or desktop wallpaper with a ransom note.
• Shared drives that are slow, then unreadable.
• Security software alerts about mass file changes or tools being disabled.
• Staff saying "my computer has gone weird" on several machines at once.

Treat any of these as a possible attack until someone qualified says otherwise.

Minutes 0 to 10: stop the spread

Speed matters most here. Ransomware usually spreads across a network, so the aim is to cut infected machines off.

1. Disconnect affected devices from the network. Unplug the network cable and turn off Wi-Fi. If you are not sure which devices are affected, disconnect any that show signs.
2. Leave them powered on unless an expert tells you otherwise. A running machine can hold evidence that helps responders work out what happened. Switching off can also interrupt some recovery options.
3. If it is spreading fast and you cannot tell what is infected, consider disconnecting the office from the internet at the router or unplugging the main network switch. This is disruptive, but it buys time.
4. Tell staff to stop working on shared files and not to plug in USB drives or connect personal devices.
5. Do not delete anything, including ransom notes, encrypted files or strange programs. They are evidence.

If you have endpoint detection and response (EDR), your IT provider or managed response team may be able to isolate devices remotely, cutting them off from everything except the security platform. That is faster and more precise than pulling cables. Our guide on what MDR actually does explains how that works.

Minutes 10 to 20: get help on the phone

You should not handle this alone. Call, in this order:

1. Your IT provider or whoever looks after your systems. Tell them it is a suspected ransomware attack, not a routine fault.
2. Your security or MDR provider, if you have one, if your IT provider is not already doing this.
3. Your cyber insurer's incident line, if you have cyber insurance. Many policies include an emergency response service, and some require you to notify them quickly or to use their approved responders. Check your policy wording. Calling early protects your claim.
4. A named decision-maker inside the business: owner, managing director or whoever can authorise spending and sign off on difficult choices.

Use phones, not company email or Teams, to coordinate. If the attacker has access to your Microsoft 365 or email, they may be reading your messages. Set up a WhatsApp or Signal group on personal phones if needed.

Start a written log now. Note the time, what you saw, what you did and who you spoke to. A notebook is fine. Your insurer, the police and the ICO may all want this later.

Minutes 20 to 40: protect what is still clean

Once help is coming, focus on the things that will let you recover.

Protect your backups

Your backups are what the attacker most wants to destroy, because they are what lets you recover without paying.

• If you have a USB or network backup drive that is still connected, disconnect it now.
• Ask your IT provider to check whether cloud backups are intact and to lock down access to the backup system.
• Do not start restoring yet. If the attacker is still in the network, restored data can be encrypted again.

The NCSC stresses that it is essential to always have a recent offline backup of your most important files and data, kept separate from your network.¹ If yours is offline and untouched, that is very good news.

Lock down accounts

Attackers often get in using stolen passwords and then create or take over administrator accounts.

• From a device you know is clean, have your IT provider reset administrator passwords and any accounts known to be involved.
• Check for new or unexpected admin accounts in Microsoft 365 and on your servers.
• Make sure multi-factor authentication is on for admin accounts.

Preserve evidence

Do not wipe and reinstall machines yet, however tempting it is. Responders need to work out how the attacker got in, otherwise they may simply come back. Photograph ransom notes and on-screen messages, and keep copies of any alerts.

Minutes 40 to 60: report it

Reporting is not just a box to tick. It can get you practical help, and in some cases it is a legal requirement.

The ICO's 72-hour clock catches people out. If customer, staff or supplier personal data has been encrypted, copied or exposed, you may need to report even if you are not yet sure of the full picture, so get advice early rather than waiting for the investigation to finish. Many ransomware groups now copy data before encrypting it, so do not assume "we have backups" means "no breach".

What not to do in the first hour

• Do not contact the attackers. Leave any negotiation to specialists, if it ever comes to that.
• Do not pay the ransom. UK law enforcement does not encourage, endorse or condone paying ransom demands. Paying does not guarantee you will get your data or systems back, and your computer may still be infected.¹
• Do not wipe devices before responders have looked at them.
• Do not restore from backup until the attacker has been removed.
• Do not announce it publicly before you have spoken to your insurer and advisers. Do tell staff what they need to know.
• Do not trust free decryptor sites at random. If decryption tools exist for your strain, the No More Ransom project collects legitimate ones,¹ but let your responders check first.

After the first hour

The next days are about investigation and recovery: finding out how the attacker got in, removing them completely, restoring clean systems from backup, and deciding with your insurer and advisers whether further notifications are needed. This is specialist work for your IT provider and incident responders.

It is also worth being clear about what security tools can and cannot do here. Endpoint protection and managed response are designed to stop ransomware before it encrypts anything, or to contain it within minutes. They do not rebuild servers or restore data. Coffee Cyber, for example, provides CrowdStrike protection and rollout help, but not incident recovery; our had a breach page points you to the right kind of help.

Prepare now: a one-page plan

Only 25% of UK businesses have a formal incident response plan,⁵ yet 43% had a breach or attack in the last 12 months.⁵ You do not need a 40-page document. One page, printed and kept offline, covers most of what matters.

Fill in:

• IT provider: name, out-of-hours number, account reference.
• Security or MDR provider: name and emergency contact route.
• Cyber insurer: policy number and incident line.
• Decision-makers: two people who can authorise spending, with personal mobile numbers.
• Backups: where they are, who can check them, when they were last test-restored.
• Reporting: Action Fraud 0300 123 2040, NCSC at report.ncsc.gov.uk, ICO breach reporting.
• Communications: the backup way to reach staff if email is down.

Then reduce the chance of needing it. The basics in Cyber Essentials (firewalls, secure configuration, security updates, user access control and malware protection)⁶ block many common attacks. Multi-factor authentication, offline backups you have actually tested, and endpoint protection that someone is watching around the clock do the rest. Our page on ransomware protection covers how we approach it, and the NCSC's free Cyber Action Toolkit is a good place for small businesses to start.⁷

Common questions