Ransomware hit your company? What to do in the first hour

The ransom note appears, files are encrypted and staff are calling. Teams tend to make rushed decisions now: shut everything down, wipe machines or contact the attacker. Here's an organized plan instead.

1. Isolate, don't power off

Disconnect infected machines from the network (cable and Wi-Fi) but leave them running if possible. Memory (RAM) can hold encryption keys and attacker traces that are lost on shutdown.

2. Protect your backups

Disconnect backup servers and attached storage immediately and change their credentials. Many attackers hunt for backups and delete them before or after encrypting.

3. Disable compromised accounts

Disable suspected accounts, especially administrators and remote access (VPN, RDP), and reset privileged passwords from a clean device.

4. Document before you clean

• Photograph the ransom note, encrypted file names and their extension
• Record the discovery time, every action taken and who took it
• Keep firewall, server and security tool logs
• Don't wipe or reinstall any machine before taking a forensic image

5. Form the decision team

Name one incident lead and involve management and legal. Decide early what must be communicated to customers, authorities and any insurer.

6. On paying the ransom

Paying doesn't guarantee recovery or that data won't be leaked, and it can fund future attacks. The decision needs legal and technical assessment — not a first-hour reaction.

After containment

Digital forensics establishes how the attacker got in, what data they took and when the attack really began. Without it you may restore systems and leave the door open for the next attack.

How WebShield helps

We provide incident response and digital forensics: containment, evidence preservation with a documented chain of custody, malware analysis and a report explaining what happened and how to prevent a repeat.