First actions: isolate and escalate
A ransom note, changed file extensions or suddenly unreadable files may indicate ransomware. Data can also be stolen before encryption. Treat an extortion message seriously without assuming every claim is true.
Disconnect affected devices. Unplug network cables and turn off Wi-Fi. Stop connections to shared storage and backups. For managed systems, contact the response team immediately and use its coordinated containment plan.
Use a separate communication route. Contact your IT provider or incident lead from a clean phone or device. Work email and chat may be compromised.
Avoid destructive changes. Do not factory-reset, reinstall, delete notes or run random decryptors before evidence is preserved. Do not routinely power off a disconnected device: memory may contain useful evidence. If it cannot be isolated and encryption is spreading, shutdown may be necessary; get urgent responder advice where possible.
First hour: protect clean systems and record the scope
For organisations, appoint an incident lead, a technical lead and someone to keep the timeline. Record affected devices, services, shared drives, first observations and business impact. Separate confirmed facts from assumptions. Prioritise life-safety and essential services through existing continuity procedures.
Protect backup administration and offline copies from affected accounts. Do not connect a backup drive to an infected computer or restore into a compromised environment. Let responders decide which accounts, remote access and network paths to suspend without locking out recovery teams.
Before cleanup: preserve evidence and assess exposure
Keep the ransom note, screenshots, affected filenames, relevant alerts, logs and the approximate time encryption began. Specialists should capture system images or volatile evidence where appropriate.
Keep evidence in restricted storage. Do not upload confidential documents or stolen datasets to public analysis sites.
Investigate account misuse, possible data theft and affected suppliers as well as encrypted files. Restoring operations does not resolve a possible data breach.
Prepare an incident report and use verified NC4 channels; check whether online intake is live. A preview form does not lodge an operational report. Organisations should involve their privacy or legal lead to assess applicable notifications using ODPC guidance. Do not wait for complete attribution before escalating.
Plan recovery: rebuild on a trusted foundation
Address the entry point. With your responder, remove malicious access, review exposed accounts and patch the weakness used. Rebuilding a device while leaving stolen administrator access active can lead to reinfection.
Choose a clean recovery point. Check that backups predate the compromise, not just the encryption. Test restoration on an isolated clean environment before trusting the result.
Restore essential services in stages. Reinstall from trusted media, apply security updates and reset affected credentials in a controlled sequence. Validate business records and dependencies with the service owner.
Reconnect deliberately. Monitor a restored system before broader rollout. Record who approved each return to service and how to isolate it again if suspicious activity returns.
If backups are missing or a ransom is demanded
Do not pay a ransom. Payment does not guarantee working decryption or deletion of stolen information. Do not let an attacker's deadline replace your response process. Bring demands to your incident lead and law enforcement; organisations should obtain appropriate legal advice on their circumstances.
Recovery check: validate operations and learn
Confirm essential services work, restored files are usable, unauthorised access is removed and monitoring shows no renewed activity. Track outstanding data exposure separately. Document decisions, strengthen backup and restore practices and rehearse the revised response plan.
Useful references
Here to help
Something doesn’t look right?
Prepare an incident report with the details that matter.