Ransomware attack: what to do in the first hour

Ransomware is engineered to make you act before you think: countdown timers, threats to leak data, and a payment address one click away. The attackers have rehearsed this moment hundreds of times. You have not — which is exactly why your first hour should follow a checklist, not an instinct.

The good news: the correct first moves are simple, and none of them require special tools. They require restraint.

Do this now

1. Disconnect, don't power off. Unplug network cables or disable Wi-Fi on affected machines, but leave them running. Powering off destroys memory that may contain encryption keys, attacker tooling, and the clearest record of what happened.
2. Protect the backups. Take backup systems offline or lock their accounts now, before doing anything else, and identify your last known-good copy. If backups survive, most of your leverage survives with them.
3. Photograph the ransom note. Capture every variant of the note, the changed file extensions, and any onion or contact addresses, with your phone. Note the time you first saw each one.
4. Contain the accounts. From a device you trust — not an affected one — change passwords for privileged and administrator accounts and revoke active sessions where you can.
5. Move communication out of band. Assume the attacker can read company email and chat. Coordinate by phone or a personal-device messenger until responders confirm what is compromised.
6. Engage professional responders. The earlier scoping starts, the more options remain open — free decryptors, clean recovery paths, and an informed negotiation posture if it ever comes to that.

What not to do

• Do not contact or pay the attackers on your own — first contact sets the tone, the price, and the legal exposure of everything that follows.
• Do not run antivirus "cleanup", delete encrypted files, or remove ransom notes. They are evidence.
• Do not restore backups onto infrastructure the attacker may still control.
• Do not reboot or power off encrypted machines.
• Do not discuss the incident over company email or chat the attacker may be reading.

Preserve the evidence

Whatever else happens, these are the artifacts the investigation — and any insurance claim, dispute, or prosecution — will be built from:

• The ransom notes and a few sample encrypted files, left in place.
• One affected machine kept network-isolated but powered on, untouched.
• Firewall, VPN, and remote-access logs — export them before they rotate.
• Endpoint security alerts from the days before the encryption began.
• A written timeline: who noticed what, and when, starting from the first anomaly.

Keep a clear head

The countdown timer is theater. It exists to push you into the one irreversible decision — payment — before you understand your position. Hours spent scoping almost always buy better options, not worse ones.

Name one person to lead, one to take notes, and slow the room down. A ransomware event is a marathon in its first mile; teams that pace themselves recover faster and lose less.

Questions victims ask