What to do in the first hour after discovering ransomware

Discovering ransomware is one of the worst moments a small business can have, and the instinct to act fast is right, but acting in the wrong order can make recovery slower or destroy evidence you'll want later. This is a time-ordered checklist, not a replacement for the full recovery guide, which covers the actual restore process in depth.

First 10 minutes: contain it

1. Disconnect affected machines from the network immediately, Wi-Fi and Ethernet both. Don't shut them down yet; powering off can destroy evidence useful for understanding what happened.
2. Don't try to "clean" files or run removal tools yet. That can overwrite evidence and, in some cases, make files unrecoverable.
3. Notify whoever owns IT or security decisions at your business right away, even if you're not fully sure yet what's happening.

First hour: assess scope, don't restore yet

1. Identify which systems and shares are affected. Check unaffected systems too; ransomware often spreads before it's noticed.
2. Do not pay the ransom, and don't negotiate with an attacker on your own without guidance; involve law enforcement or a security professional in that decision if it comes up.
3. Start a simple written timeline: when it was noticed, what's affected, and what actions have been taken. This becomes useful for both recovery and any required incident reporting.
4. If you're on Recovery Ready, contact the priority recovery hotline now; a specialist can help plan the restore alongside you rather than after the fact.

Next 24 hours: plan the actual recovery

1. Determine how far back you need to roll: version history lets you restore to a point before the attack. See the ransomware recovery guide for how to identify a clean recovery point.
2. Rebuild or clean affected machines before restoring data onto them.
3. Restore in a controlled order, critical systems first, verifying each one before moving to the next rather than restoring everything at once.
4. Change credentials for any accounts that may have been exposed, not just the ones on the affected machines.

After it's resolved: don't skip the review

Once systems are back up, take the time to understand how the attack got in, whether it was phishing, an exposed remote access point, or something else, and close that gap. If you run quarterly recovery drills, this is also worth feeding back into your next one; see running a recovery drill without disrupting your team.