Picture this. It’s Monday morning. The first person in turns on the lights, starts the coffee and logs in. The desktop wallpaper has been replaced with a block of text. Every file on the shared drive has a strange new extension tacked onto the end, and none of them will open. There’s a note in every folder explaining, politely, that your data has been encrypted and you can have it back for a price.
Here’s a call we get some version of more often than we’d like. The person on the other end is usually calm on the surface and panicking underneath, and the first question is almost always the same: “Do we pay?”
Not yet. The first hour of a ransomware attack matters more than almost anything that follows, and most of what helps is unglamorous: unplugging things, writing things down and not making it worse. This is the checklist we’d want you to have taped inside a cabinet before you ever need it.
Quick answer: If you’re hit by a ransomware attack, disconnect affected computers from the network right away but don’t power them off or wipe them, and don’t pay or contact the attackers yet. Photograph the ransom note, write down what you saw and when, then call your IT provider and your cyber insurer before anyone starts “fixing” things. Only then check whether your backups are intact and isolated, because restoring onto an infected network can undo the whole recovery.
What should you do first when ransomware hits?
Cut the infected machines off from everything else, without shutting them down. Ransomware spreads across shared drives and network connections, so every minute a machine stays connected is a minute it can reach more files.
- Unplug the network cable from any computer showing the ransom note or renamed files. On laptops, turn off Wi-Fi.
- Leave the machines powered on unless your IT provider tells you otherwise. Memory can hold clues about how the attackers got in, and some recovery tools rely on it.
- Disconnect shared storage and backup drives that are plugged in. A USB backup drive still attached to an infected server is not a backup anymore; it’s another target.
- Tell staff to stop logging in and to leave their computers alone until someone gives the all-clear. A quick phone call or text works better than email, which may itself be compromised.
Should you pay the ransom?
Not in the first hour, and quite possibly not at all. Paying doesn’t reliably get your files back, the decryption tools attackers hand over are sometimes slow or broken, and payment doesn’t stop them from leaking data they’ve already copied.
There’s also a legal side. Payments to certain sanctioned groups can create their own problems, and many cyber insurance policies require you to involve them before any negotiation happens. That decision belongs to the business owner, the insurer and legal counsel, made with full information. It doesn’t belong to whoever happens to be sitting at the infected computer on Monday morning.
Why shouldn’t you wipe and reinstall right away?
Because wiping destroys the evidence of how the attackers got in, and if you don’t know how they got in, they can walk right back through the same door. A fresh reinstall on a network that still has a compromised password or an open remote access port is a rebuild with a short shelf life.
Wiping also takes away options. Some ransomware strains have known weaknesses, and your insurer or an incident responder may want images of affected drives before anything is touched. You can always wipe later. You can’t un-wipe.
What evidence should you preserve?
Preserve anything that shows what happened and when. You don’t need to be a forensic investigator; you just need to avoid destroying what a professional will ask for.
- Photos of the ransom note and the screen (a phone camera is fine)
- A sample of the renamed file extensions
- Who noticed it first, on which computer, and at what time
- Any odd emails, pop-ups or password prompts anyone remembers from the past few days
- Firewall, server and antivirus logs, left in place rather than cleared
Start a simple written timeline on paper or on a computer that wasn’t affected. It will matter for your insurer, for any breach notification decisions and for figuring out the entry point.
Who do you need to call?
Call your IT provider first, then your cyber insurance carrier, then decide with them who else needs to know. In practice, that list often includes:
- Your IT support provider, to contain the spread and assess the damage
- Your cyber insurer, since many policies have specific reporting steps and approved responders
- Your attorney, especially if client or employee personal information may have been exposed
- Law enforcement, such as the FBI, which takes ransomware reports; federal guidance is collected at CISA’s StopRansomware site
If you’re a Massachusetts business, there’s one more thing to keep in mind. State law requires notice to affected residents and to state regulators when personal information is breached, and 201 CMR 17.00 expects you to have a written security program and an incident response process in place. Whether a particular attack triggers notification is a question for counsel, but the evidence you preserve in the first hour is what lets them answer it. Our compliance support page covers the WISP side of this in more detail.
How do you know if your backups will save you?
Your backups will only save you if the attackers couldn’t reach them. Modern ransomware crews often go looking for backup shares and backup servers before they launch the encryption, which is why a backup that’s always connected to the network is so fragile.
Once the spread is contained, ask these questions before restoring anything:
- Is there a backup copy that was offline, off-site or immutable (unable to be changed) at the time of the attack?
- When was the most recent clean copy taken, and does it predate the attackers’ first access, not just the encryption?
- Has anyone actually tested restoring from it recently?
- Has the entry point been found and closed, so you aren’t restoring clean data into a still-compromised network?
If the answers are shaky, that’s not a reason to give up. It’s a reason to slow down and get help before restoring. We wrote more about how attackers target backups in our post on the top cybersecurity threats facing Massachusetts businesses.
How we can help
Systems Analysis Services has supported businesses from our office in Newton since 1978, and when a client calls with a ransom note on the screen, our job is to help them contain it, figure out how it happened and get back to work on clean systems. Our ransomware recovery service covers containment, assessment and restoration planning, and our backup and disaster recovery work is about making sure the next Monday morning ends with a restore instead of a ransom. For the bigger picture, start at our cybersecurity services hub.
If this is happening to you right now, call 617-965-4615. Our office hours are Monday to Friday, 9am to 5pm, and you can call after hours for emergencies. If you’re reading this as a precaution, which is the better position to be in, send us a message and we can talk through your backups and response plan before anyone in Greater Boston has to find out the hard way.
Frequently Asked Questions
Should I turn off my computer if I get ransomware?
Usually no. Disconnect it from the network by unplugging the cable or turning off Wi-Fi, but leave it powered on unless your IT provider says otherwise, because shutting down can destroy information that helps with investigation and recovery.
Can I just restore from backup and move on?
Only after the attackers’ way in has been found and closed and you’ve confirmed the backup is clean. Restoring onto a network that is still compromised can lead to a second round of encryption.
Do I have to report a ransomware attack in Massachusetts?
If personal information of Massachusetts residents may have been accessed or acquired, state breach notification law may require notice to those residents and to state regulators. Talk to your attorney early, and preserve evidence so they can make that call accurately.
Will antivirus remove ransomware and get my files back?
Security software may remove the ransomware program itself, but it generally can’t decrypt files that have already been encrypted. Getting files back usually depends on clean, isolated backups.
How can a small business prepare before an attack happens?
Keep at least one backup copy offline or immutable, test restores regularly, turn on multi-factor authentication for email and remote access, and write down who to call and in what order. A one-page plan that people can find is worth more than a long one nobody has read.
Need a hand with this? Systems Analysis Services in Newton, MA can help.
Call 617-965-4615 or send us a message.
