The first 24 hours after a ransomware attack: what to do and what not to do

The first sign is usually obvious: files with strange new extensions, a ransom note on the desktop or in every folder, or staff suddenly locked out of shared drives. What happens in the next few hours decides how much you can get back. Well-meant actions in a panic, like wiping machines, restoring backups straight away or running clean-up tools, are some of the most common reasons data that could have been recovered is lost for good.

This guide covers what to do, and what to leave alone, in the first 24 hours after a ransomware attack, before recovery work starts.

1. Isolate, but don’t switch everything off

Your first job is to stop the encryption spreading. Disconnect affected computers and servers from the network: unplug the network cable and turn off Wi-Fi. If the attack is spreading quickly, disconnecting the internet connection or shutting down network switches can buy time.

Where you can, leave affected machines powered on but disconnected rather than shutting them down. A running system can hold information that disappears when it is turned off, including details about what was run and, occasionally, material that helps with recovery. If a machine is actively encrypting and you cannot disconnect it, powering it off is the lesser evil.

2. Protect your backups

Attackers often go after backups first, because a working backup removes their leverage. Immediately disconnect any backup drive, NAS or backup server that is still attached to the network, and do not connect a backup to an affected machine to “check it”. Change the passwords for your cloud backup service from a clean device. Your backups may be the most valuable thing you still have; treat them that way until you know how the attackers got in.

3. Don’t pay, and don’t contact the attackers yet

UK law enforcement and the National Cyber Security Centre advise against paying ransoms. Payment does not guarantee you will get a working decryption key, does not stop stolen data being published, and marks you as a business that pays. Even if you are considering every option, don’t open negotiations in a hurry. Get advice first: what has actually been encrypted, whether backups survived and whether recovery is possible without the attackers.

4. Keep the evidence

• Don’t delete the ransom note or the encrypted files. The note identifies the ransomware family, and encrypted files may become recoverable later if a decryptor is released or a weakness is found.
• Don’t reformat drives or reinstall systems. That destroys both evidence and anything recoverable from the original disks.
• Don’t run antivirus “clean-up” or file recovery tools on affected machines yet. They can delete malware samples and overwrite data that recovery depends on.
• Write a timeline as you go: when the problem was noticed, by whom, what was seen, and every action taken since. Screenshots or phone photos of screens and messages help.

5. Secure your accounts from a clean device

Ransomware is rarely the start of an attack; it is usually the end. Attackers will typically have had access for some time, often through stolen passwords, an exposed remote access service or a phishing email. Using a device you are confident is clean, reset passwords for administrator accounts, email, remote access and cloud services, and check that multi-factor authentication is switched on and hasn’t been changed. Review any new user accounts or mail forwarding rules you don’t recognise.

6. Make the right calls

• Your cyber insurer, if you have a policy. Many policies require prompt notification and may need to approve who carries out the response.
• The police. Report the attack to the national fraud and cyber crime reporting service for England, Wales and Northern Ireland, or to Police Scotland if you are in Scotland. A crime reference can be needed for insurance claims.
• The ICO, if personal data may have been accessed or made unavailable. Under UK GDPR, a reportable personal data breach must be reported within 72 hours of you becoming aware of it.
• Your bank, if payment systems or finance staff email accounts may be involved.

7. Don’t restore until you know how they got in

It is tempting to wipe everything and restore from the last good backup as soon as possible. If the way in hasn’t been found and closed, the attackers can simply return and encrypt the restored systems, sometimes within days. Restoring too early can also overwrite evidence. Recovery should follow a compromise assessment that identifies the entry point and checks the backups themselves are clean.

Getting help

If you are dealing with an attack now, our rapid triage and containment service helps isolate systems and work out what has been affected. Where files have been encrypted and backups are missing or damaged, ransomware data recovery looks for recoverable data from shadow copies, partial backups and unaffected storage. The sooner we are involved, the more options remain.