The first hour of a ransomware attack: what to do and what not to do

The clock starts immediately

Ransomware (show definition) locks files and demands payment to release them. The moment you notice something is wrong, files renaming themselves, a ransom note on screen, systems locking up, the decisions you make in the next hour shape how the rest of the incident goes.

Do this first

1. Disconnect affected devices from the network. Unplug the ethernet cable or turn off Wi-Fi. Do not power the device off yet.
2. Call your incident response provider or managed security partner.
3. Call your cyber insurance carrier to open a claim and get guidance on approved vendors.
4. Call legal counsel, since notification obligations may apply depending on what data was involved.
5. Report the incident to law enforcement, including the FBI's Internet Crime Complaint Center at ic3.gov.

Do not do these things

• Do not reboot or reimage machines before forensic evidence is captured.
• Do not assume backups are clean without checking them.
• Do not post about the incident publicly before legal counsel has weighed in.
• Do not pay the ransom on your own, especially before checking sanctions requirements with OFAC (show definition).

Why disconnecting matters

Ransomware often spreads across a network automatically, looking for more devices to encrypt. Disconnecting an affected device from the network can stop it from reaching more systems, while leaving it powered on preserves information your incident response team may need.

Who should already be on your call list

• Incident response provider or managed security partner
• Cyber insurance carrier and broker
• Legal counsel
• Internal leadership who need to be looped in immediately
• Law enforcement contact or ic3.gov

Having this list written down, before an incident, saves precious minutes when it happens.

A note on notification

Depending on your state and industry, you may have a legal obligation to notify affected individuals or regulators if certain data was involved. This is general information, not legal advice. Talk with legal counsel about what applies to your business.