Ransomware: what to do in the first hour

Ransomware encrypts files and demands a ransom to decrypt them. Often the attackers have also copied data and threaten to publish it. The first decisions matter: they limit the spread and preserve the traces needed for the investigation.

The most important thing is to stay calm and follow a clear order.

First steps

• Isolate the affected machines: unplug the network cable and turn off Wi-Fi.
• Do not shut them down abruptly without advice: some traces useful for the investigation are lost on shutdown.
• Alert your IT provider or IT manager immediately, through the channel set in your contract (the support number if there is one), and confirm in writing.
• Write down the time and what you observed, and photograph the ransom message.
• Do not connect any backup drive to an affected machine.

What to avoid

• Deleting files or reinstalling machines before the investigation.
• Contacting the attackers on your own.
• Communicating through internal messaging, which may be monitored: use the phone instead.
• Reconnecting machines too soon, before the entry point has been identified.

Who to notify

• Your IT provider, who can coordinate the technical response under your contract (often billed by the hour if no incident response service is subscribed).
• Your insurer, if you have cyber insurance: many offer assistance and set deadlines for reporting a claim.
• The cantonal police, to file a complaint.
• The Federal Office for Cybersecurity (FOCS), through its reporting form.
• The Federal Data Protection and Information Commissioner (FDPIC), if personal data is affected and there is a high risk for the people concerned.

Should you pay the ransom?

The Swiss authorities advise against paying. Paying guarantees neither a working key nor the deletion of stolen data, and it funds further attacks. If the question arises anyway, it should be handled with your insurer and specialists, never alone and in a rush.

Getting back to business

• Restore from clean backups, ideally an immutable copy the attack could not reach.
• Rebuild machines rather than trying to clean them.
• Change every password, starting with administrator accounts.
• Identify and close the entry point before reconnecting everything.
• Bring systems back online in order of priority, following your recovery plan.

Preparing in advance

The companies that cope best have prepared the ground: immutable, tested backups, multi-factor authentication, protected and monitored computers, updates kept current, and a printed response sheet with the key contacts. A one-hour exercise once a year is enough to check that everyone knows what to do.