Ransomware Response: What Your Business Should Do First

If ransomware is encrypting systems or displaying ransom notes, treat it as an active security incident. Isolate affected devices, activate the incident-response plan, preserve evidence, and bring in qualified responders. Do not improvise a mass shutdown, wipe systems, reconnect backups, or negotiate from a compromised account.

This guide is a planning aid, not a substitute for your incident-response team, insurer, legal counsel, law enforcement, or regulatory obligations.

The first 15 minutes: stop the spread

Declare an incident. Notify the designated incident lead and use the emergency contact tree. Move sensitive coordination to a known-clean, out-of-band channel if company email or chat may be compromised.
Identify and isolate affected systems. Disconnect network cables and disable Wi-Fi, Bluetooth, VPN, and other network connections. Isolate affected network segments or accounts from a central console if responders can do so safely.
Power down only when isolation is not possible. CISA advises powering down a device if you cannot disconnect it from the network. Otherwise, responders may want the system left on to preserve volatile evidence. Follow your plan or forensic lead.
Protect unaffected systems and backups. Stop replication or backup jobs only under the recovery team's direction so encrypted or corrupted data is not propagated. Do not attach backup media to the compromised environment.
Do not delete the ransom note or reimage the machine. Photograph the screen, record the time, hostname, user, visible extension changes, and how the issue was discovered.

If patient safety, physical operations, emergency services, or other life-safety systems are affected, escalate through the applicable emergency and sector-specific procedures immediately.

The first hour: activate the response team

Bring together the roles named in the incident plan:

incident-response and security lead;
IT operations, identity, network, cloud, and backup owners;
executive decision-maker and business-continuity lead;
privacy or legal counsel familiar with breach response;
cyber-insurance contact, following the policy's notice and vendor requirements;
forensic response provider, if not handled internally;
communications and customer-support leads; and
law enforcement or the appropriate national cyber authority.

Do not let every administrator work independently. Create one incident log and record decisions, actions, evidence locations, responsible people, and times.

Preserve evidence before rebuilding

The response team may need memory captures, disk images, security logs, identity events, firewall records, email traces, cloud audit logs, malware samples, ransom notes, and network telemetry. Preserve original timestamps and chain-of-custody information.

Avoid �cleaning up� logs, running unapproved malware removers, or resetting every system before the forensic team determines what evidence is needed. Credential rotation is important, but do it from known-clean systems in a coordinated order so attackers cannot capture the new credentials.

Determine the scope

Answer these questions with evidence:

Which endpoints, servers, cloud resources, identities, and locations are affected?
Is encryption still active or spreading?
Which privileged accounts, remote-access tools, tokens, or service credentials may be compromised?
When did the earliest suspicious activity occur?
Were backups, hypervisors, management tools, or identity systems reached?
Was data accessed, staged, or exfiltrated before encryption?
Which critical services are unavailable, and what manual continuity process can replace them?

Do not assume the first encrypted laptop is the point of entry. The attacker may have been present earlier and may retain access through another account or system.

Report and assess notification duties

In the United States, the FBI asks ransomware victims to contact a local field office or report through the Internet Crime Complaint Center. CISA also provides reporting and response resources. Other countries have their own national cyber authorities.

Legal, contractual, sector, and insurance notification duties depend on the data, location, industry, customers, and timing. Counsel should assess them from the evidence; an encryption event is not automatically the same as confirmed data theft, and an absence of proof is not proof that nothing left the network.

Should the business pay?

The FBI does not support paying a ransom. Payment does not guarantee a working decryptor, complete recovery, deletion of stolen data, or an end to further demands. It can also create legal or sanctions risks and encourage additional crime.

If leadership considers payment, the decision should involve legal counsel, the insurer, law enforcement, and experienced incident responders. Preserve the ransom note and communication details, but do not negotiate from an ordinary employee account or improvise a cryptocurrency payment.

Validate backups before restoration

Backups are useful only if they are intact, clean, and restorable. Before recovery:

Inventory all backup systems, copies, snapshots, and restore points.
Check whether attackers accessed the backup console or credentials.
Identify restore points from before the earliest known compromise, not merely before encryption became visible.
Scan and validate backup integrity in an isolated environment.
Test restoration of representative systems and business data.
Document recovery point and recovery time expectations with business owners.

Do not reconnect a clean backup to an environment that still contains the attacker's access path.

Recover in a clean, prioritized environment

Recovery is not simply decrypting files or restoring an image. The team must remove persistence, correct the exploited weakness, and rebuild trust.

Establish clean administration devices, accounts, and communication channels.
Rebuild identity, network, logging, and core security services in the planned order.
Patch exploited vulnerabilities and remove unauthorized remote-access tools or accounts.
Rotate privileged, service, API, and user credentials in a coordinated sequence.
Restore the most critical business services from validated backups.
Test functionality, security controls, and data integrity before production release.
Reconnect systems in stages and monitor closely for renewed malicious activity.
Keep compromised systems isolated until evidence collection and eradication are complete.

Communicate without creating new risk

Use an approved spokesperson and consistent facts.
Tell employees what systems not to use and how to report new symptoms.
Do not speculate about attribution, data theft, recovery time, or payment.
Coordinate customer, regulator, partner, and media messages with counsel and incident leadership.
Never include sensitive forensic details in a public update unless the response team approves them.

Ransomware response checklist

Phase	Required evidence or decision	Owner
Contain	Affected systems isolated; uninfected backups protected	Incident and infrastructure leads
Coordinate	Response team, insurer, counsel, forensics, and reporting channels activated	Incident commander
Preserve	Logs, system images, ransom note, timeline, and chain of custody recorded	Forensic lead
Scope	Impacted assets, identities, entry path, persistence, and possible exfiltration assessed	Security team
Decide	Business continuity, legal notifications, communications, and ransom position documented	Executive and legal leads
Recover	Backups validated; clean rebuild order and acceptance tests approved	Recovery lead
Monitor	Restored systems watched for recurrence and unauthorized access	Security operations
Improve	Root cause, control gaps, costs, and corrective actions tracked to closure	Risk owner

Prepare before an attack

Maintain multiple backup copies with appropriate offline, segregated, or immutable protection, and test restores.
Define recovery priorities, recovery time objectives, and recovery point objectives with business owners.
Use phishing-resistant multifactor authentication where practical, especially for administrators and remote access.
Patch internet-facing and actively exploited vulnerabilities quickly.
Apply least privilege, separate administrator accounts, and network segmentation.
Deploy centralized logging and endpoint detection, protect logs from tampering, and verify alert coverage.
Restrict and monitor remote administration tools.
Train staff to report suspicious messages and unexpected login prompts promptly.
Exercise the ransomware plan with leadership, legal, communications, IT, and third-party providers.

Endpoint security is one layer, not the whole program; this comparison of Microsoft Defender and Bitdefender explains common protection features. For storage designs that include versioning and snapshots, review these private cloud storage options, then validate the product against your organization's backup and recovery requirements.

During an incident, use CISA's Ransomware Response Checklist. The FBI's ransomware guidance explains reporting and ransom-payment concerns, and NIST's ransomware protection and recovery resources support longer-term planning.