Ransomware Infection: What to Do in the First Hour

Ransomware can encrypt files, interrupt business operations and sometimes involve stolen information. The early response should prioritize containment and preserving what investigators or recovery specialists may need.

1. Record what you see

Photograph ransom notes, unusual file extensions and any messages. Note when the problem began, which computers or shares are affected, and what someone was doing before the first alert. Avoid deleting ransom notes or changing files unnecessarily.

2. Protect unaffected systems and backups

Keep offline backups disconnected. Prevent the affected computers from reaching shared storage or other systems. Use a known-clean device to communicate and review your recovery plan.

3. Do not guess at decryption or cleanup

Removing a malicious program does not decrypt encrypted files. Unknown decryptors, improvised repair attempts and unverified restoration procedures can destroy evidence or damage remaining data.

4. Consider business reporting obligations

Depending on the organization, data involved, insurance policy and jurisdiction, there may be notice, reporting, preservation or insurer requirements. Your legal, insurance and incident-response advisors should help determine those obligations.

5. Plan restoration only after containment

Affected systems may need to be rebuilt before reliable recovery. Verified clean backups or a reputable decryptor for a specific strain may help, but recovery cannot be guaranteed.

Computer Hospital can discuss scope and next steps. If you suspect active ransomware, see Ransomware Removal & Remediation and recovery options after ransomware.