Ransomware: What to Do in the First Hour

Ransomware is malicious software that locks your files or systems and demands payment to unlock them. Often the attackers also copy your data first and threaten to publish it. It usually shows up as a ransom note on screen, files that suddenly won't open or have strange extensions, or several computers acting up at once.

The first hour matters most. What you do in those minutes decides how far the attack spreads, whether your backups survive and how much evidence is left for investigators and your insurer. This article is a plain-language guide for business owners. Print it, and keep it somewhere you can find it without your computer.

Minute one: stop the spread

The single most important step is to cut infected devices off from everything else. CISA's guidance is to identify the affected systems and isolate them immediately (CISA: I've been hit by ransomware).

• Unplug the network cable and turn off Wi-Fi on any computer showing signs of infection.
• Don't turn it off. CISA advises against powering down unless there's no other way to disconnect it, because shutting down can destroy evidence held in memory.
• If several computers are affected, disconnect the office from the internet and the internal network, for example by unplugging the main network switch or internet router.
• Disconnect backup drives and network storage right away, so the ransomware can't reach them.

Don't click anything in the ransom note, don't run random "ransomware removal" tools you find online, and don't delete files. Take a photo of the ransom note with your phone instead.

Minutes 5 to 15: make the right calls

Call, don't email. If attackers are inside your network, they may be able to read your company email. CISA recommends using out-of-band communication, such as phone calls, so the attackers don't learn what you're doing.

1. Your IT provider. They should know your systems, have access to your security tools and be able to start containing the attack quickly.
2. Your cyber insurance carrier. Many policies require prompt notice and have a hotline that connects you to an approved response team. Bringing in your own outside vendors before you call the insurer can complicate a claim, so check your policy now, before you ever need it.
3. The decision-maker. One person, usually the owner, should own decisions from this point on, so staff aren't getting mixed instructions.

Minutes 15 to 30: protect the evidence and your options

• Write down a timeline. When was the problem first noticed, by whom, on which computer, and what did they see? Keep these notes on paper or a phone, not on the company network.
• Don't wipe or rebuild anything yet. Reinstalling a computer feels productive, but it can destroy the evidence your IT provider or insurer needs to figure out how the attackers got in. If you don't find the entry point, they can come back.
• Change key passwords from a clean device. Once your IT provider agrees, reset passwords for email administrators, banking and other critical accounts using a computer or phone that was never on the infected network. Make sure multi-factor authentication is on for those accounts.
• Tell staff what to do. Keep it short: don't use the affected computers, don't discuss the incident on social media or with customers yet, and route all questions to one person.

Minutes 30 to 60: report it and plan the recovery

Report the attack. CISA lists several options: CISA itself, your local FBI field office or the FBI's Internet Crime Complaint Center at ic3.gov. Law enforcement may know the ransomware variant and, in some cases, whether a decryption tool exists.

About paying: the FBI does not encourage paying a ransom, because it funds more attacks and doesn't guarantee your files come back (FBI Tampa). Whatever you decide later, don't contact the attackers on your own in the first hour. That conversation, if it happens at all, belongs to specialists working with your insurer and lawyer.

Then start planning recovery with your IT provider:

• Which backups are clean? CISA recommends restoring from offline backups, checking them for hidden malware first and bringing back the most critical systems first.
• What does the business need first? Usually email, accounting and the files or software customers depend on.
• Was data stolen? If customer, patient or employee information may have been copied, you may have legal notification duties. Your insurer and attorney will guide you on this.

What makes the first hour easier

Everything above goes faster when it's been decided in advance. A few things worth doing this month:

• A one-page response plan with phone numbers for your IT provider, insurer, bank and key staff, printed and saved on your phone.
• Backups kept separate from your network, tested regularly. At CyberArm, backup is a separate add-on, not part of our security packages, so it's worth checking exactly what you have. Our hurricane-ready IT guide covers the same backup basics.
• Endpoint protection with someone watching it, so suspicious activity is caught early, ideally before files are encrypted.
• Phishing awareness for staff, since many attacks start with an email. Our guide to spotting fake invoice and payment-change emails is a good place to start.

How CyberArm can help

CyberArm Managed IT & Cybersecurity is based in Lake Mary and works with small businesses across Central Florida. Our cybersecurity packages include endpoint protection, monitoring and response planning, and our team has 15+ years in IT, including 4+ years at the DoD.

The bottom line

In the first hour of a ransomware attack: disconnect, don't power off, call your IT provider and insurer by phone, protect your backups, write things down and report it. Don't pay, don't negotiate and don't wipe anything until experts are involved. If you'd like to know how ready your business is today, our free IT and security assessment reviews your defenses and backups and gives you a written Executive Summary with the fixes that matter most.