Ransomware Recovery for Small Business

What should you do in the first hour of a ransomware attack?

Isolate the affected machines, leave the evidence alone and get help. The goal in the first hour is to stop the spread, not to fix everything.

• Disconnect. Unplug the network cable and turn off Wi-Fi on any computer showing a ransom note or locked files. If a server is affected, disconnect it from the network too.
• Do not pay or reply. Do not click links in the ransom note or contact the attackers yet.
• Do not wipe or reinstall. Deleting files or rebuilding machines too early can destroy the information needed to understand what happened.
• Take a photo of the ransom message. Note the time and which computers are affected.
• Call us. Phone 617-965-4615. If you have cyber insurance, contact your insurer as well, since many policies have steps you need to follow.

Avoid checking email or logging in to banking from a computer you suspect is infected. Use a separate, clean device if you need to communicate.

Should a small business pay the ransom?

Paying should not be your first move. Paying does not mean you will get working data back, and many businesses that pay never fully recover their files.

Before anyone discusses payment, find out whether you have clean backups and how far the attack spread. That decision should involve your leadership, your insurer and your legal advisors. Our job is to help you understand your technical options so you are not deciding in a panic.

How do you recover from ransomware?

Recovery usually means containing the attack, cleaning or rebuilding affected systems, and restoring data from backups that are known to be clean. It is careful, step-by-step work.

• Confirm which computers, servers and accounts were affected.
• Check your backups. Attackers often go after backups too, so we confirm copies are intact before relying on them.
• Rebuild or clean affected machines rather than trusting them as they are.
• Restore data from verified backups and check that it opens correctly.
• Reset passwords and review remote access so the attackers cannot simply walk back in.

We will be honest with you: we cannot decrypt ransomware, and recovery depends on what clean copies of your data exist. That is why verified backups matter so much.

How does IBM FlashSystem help firms that hold client data?

IBM FlashSystem keeps verified, isolated restore points so a firm can recover without reintroducing hidden threats. It is a good fit for law offices, accounting firms, real estate agencies and brokerages that store client data on their own servers.

Because restore points are validated and kept apart from active systems, malicious code is less likely to spread back into your environment during recovery. FlashSystem also monitors for unusual activity, and its recovery approach is designed to restore essential systems quickly. As an authorized IBM reseller, we can design and support it, starting with a free cyber resilience assessment.

How can you prevent ransomware in the first place?

Prevention comes from steady, unglamorous habits rather than one tool. Most attacks rely on an unpatched system, a weak password or a convincing email.

• Keep operating systems and firmware updated, with monitored antivirus and EDR on every PC and server.
• Turn on multi-factor authentication for email and remote access.
• Filter email and train staff to spot phishing and fake payment requests.
• Review firewall rules and close remote access you no longer use.
• Verify backup jobs, run quarterly test restores and keep at least one copy isolated from your network.

For a broader view, read about the top cybersecurity threats facing Massachusetts businesses.