In this articleShow
Short answer: If ransomware hits, the first hour decides how bad it gets. Isolate affected machines from the network (don't power them off), preserve evidence, call your incident response contacts, and work out which backups are clean before restoring anything. This playbook gives a small team — with or without a dedicated security person — a clear sequence to follow, plus what to put in place now so recovery takes days, not weeks.
Why small teams need a written playbook
Ransomware operators target small and mid-sized organizations because they often lack round-the-clock monitoring and tested backups. Verizon's 2026 Data Breach Investigations Report found that half of ransomware victims that had previously leaked credentials had that leak within the 95 days before the attack — attackers frequently buy their way in with stolen logins. When it happens, people panic; a one-page playbook everyone has read beats improvisation.
Phase 1: The first hour
- Disconnect affected devices from the network — unplug Ethernet, turn off Wi-Fi. Don't shut them down: memory may hold encryption keys and evidence.
- Disconnect shared drives and sync clients (OneDrive, Google Drive, NAS mappings) to stop encryption spreading to shared files.
- Don't delete anything, and don't pay or contact the attackers yet.
- Photograph the ransom note and record the time, affected machines and what users saw.
- Activate your contact list: IT lead, management, your cyber insurer's hotline (insurers often require you to use their approved responders), and your incident response provider.
- Switch to out-of-band communication — phones or a separate messaging app — in case email or chat is compromised.
Phase 2: Contain and assess (hours 1–24)
- Identify the scope: which devices, servers and cloud accounts are affected? Check backups first.
- Reset credentials for administrator accounts, VPN accounts and service accounts from a clean device, and revoke active sessions.
- Block indicators the responders identify (malicious IPs, domains, files) on firewalls and endpoint tools.
- Check for data theft: most modern ransomware gangs steal data before encrypting it ("double extortion"). Look for large outbound transfers. See our guide to double extortion defense.
- Identify the variant using the ransom note or a sample (free resources like No More Ransom list available decryptors for some older variants).
Phase 3: Report and notify
- Report to law enforcement: in the US, file with the FBI's IC3 at ic3.gov and contact CISA; in the UK, Action Fraud and the NCSC. Law enforcement may have decryption keys or intelligence on the group.
- Check your legal obligations: if personal data was accessed, breach-notification laws (GDPR, US state laws, sector rules) may require notifying regulators and individuals within strict deadlines. Involve legal counsel.
- Don't publish details until you understand the scope.
Phase 4: Recover
- Verify backups are clean — restore to an isolated environment first and scan.
- Rebuild compromised systems from known-good images rather than "cleaning" them.
- Restore in priority order: identity systems (Active Directory, Microsoft 365/Google admin), then critical business systems, then everything else.
- Monitor closely for re-infection for several weeks.
About paying the ransom
Law enforcement agencies including the FBI advise against paying. Payment doesn't guarantee working decryption, funds criminal operations, may break sanctions laws if the group is sanctioned, and marks you as a payer. If paying is ever considered, it must involve legal counsel, your insurer and experienced negotiators.
Prepare now: the 10-point readiness checklist
# | Control | Why it matters |
|---|---|---|
1 | 3-2-1 backups with one copy offline or immutable | Ransomware actively targets reachable backups |
2 | Test restores quarterly | Untested backups often fail |
3 | MFA everywhere, especially email, VPN and admin accounts | Stolen credentials are a leading entry point |
4 | Patch internet-facing systems fast (VPNs, firewalls, remote access) | Exploited vulnerabilities are now the top initial access vector |
5 | Endpoint detection and response (EDR) on every device | Catches attacker activity before encryption; see CrowdStrike Falcon Go |
6 | Remove local admin rights from everyday accounts | Limits how far malware can spread |
7 | Disable or restrict RDP from the internet | A classic ransomware entry point |
8 | Printed contact list (insurer, IR firm, bank, legal, law enforcement) | You may not have email |
9 | Know where your critical data lives | Speeds up scoping and notifications |
10 | Run a tabletop exercise once a year | Turns the playbook into muscle memory |
Frequently asked questions
Should I turn off a computer infected with ransomware?
No. Disconnect it from the network instead. Powering off can destroy evidence in memory that responders may need.
Can ransomware be removed without paying?
Often, yes — by restoring from clean backups. Free decryptors exist for some older ransomware families, but not for most current ones.
Who should I call first?
Your internal IT lead and your cyber insurer's hotline (if you have cover), then an incident response firm and law enforcement.
Sources
- CISA and partners, #StopRansomware Guide
- Verizon, 2026 Data Breach Investigations Report — via Help Net Security
- No More Ransom, Decryption tools
- FBI, Ransomware prevention and response for CISOs
