If you are reading this because it is happening right now, skip to the checklist below and start with the first step. The decisions you make in the first few hours have a big effect on how much you lose and how fast you recover.
If ransomware is on your network right now
- Disconnect the affected computers from the network. Unplug the network cable and turn off Wi-Fi. Only power a device off if you cannot disconnect it.
- Don’t wipe or reinstall anything yet. You may need the evidence.
- Call people by phone, not email. Attackers can read email on a compromised network.
- Call your security or IT provider, your cyber insurance carrier, and an attorney. Insurance policies often have strict notice requirements and may direct you to specific responders.
That is the short version. The rest of this post explains why, and what comes next.
The first hour: contain it
The U.S. government’s ransomware guide, published jointly by CISA, the FBI, and partners, starts the same way: figure out which systems are affected and isolate them right away. Disconnecting from the network is usually better than shutting a machine down, because a running system can hold evidence in memory that disappears when power is cut. If you can’t disconnect it, powering it off is the fallback.
Isolate in a coordinated way, and use phone calls or another channel outside your network to coordinate. The guide notes that attackers may be watching, and tipping them off can make things worse.
Hours one to four: understand and preserve
- Document what you see. Take photos of the ransom note on screen, and write down times, affected machines, and anything unusual that happened beforehand.
- Find out how far it spread. Your responders need to know which computers, servers, and accounts are involved.
- Check your backups. Are they intact? Are they disconnected from the network? Attackers often try to destroy backups first.
- Let your responders decide when to reset passwords. Doing it too early or incompletely can leave attackers with a way back in.
- Report it. CISA recommends reporting to the FBI, CISA, or the Secret Service. You can start at CISA’s ransomware response page or ic3.gov.
Hours four to twenty-four: plan the recovery
- Decide what to rebuild from clean systems and what to restore from backup, and in what order. Prioritize the systems the business can’t run without.
- Keep clear, honest communication going with your staff. Tell clients when you have something accurate to tell them.
- Start tracking your legal notice obligations, covered below. The clock generally starts when you discover the breach.
What not to do
- Don’t rush to pay. The authors of the U.S. government guide do not recommend paying a ransom. Payment doesn’t guarantee you get your data back, and it can carry legal risk, so talk to your attorney first.
- Don’t reimage computers before evidence is preserved.
- Don’t discuss the incident over email or chat on the affected network.
- Don’t delay notifying your insurer. Late notice can complicate a claim.
- Don’t assume it is over once files open again. Attackers often leave a way back in.
Notification deadlines to know about in Louisiana
If personal information of Louisiana residents was involved, Louisiana’s Database Security Breach Notification Law generally requires notifying affected people within 60 days of discovering the breach, and the state Attorney General must receive written notice within 10 days after residents are notified. Other rules may apply on top of that, depending on your business: medical practices have HIPAA, and title and settlement companies fall under the FTC Safeguards Rule, which requires reporting certain larger breaches to the FTC within 30 days. The Attorney General explains the state process at its data breach reporting page. Your attorney should confirm exactly which rules and deadlines apply to you.
Prepare now, so the next one is a bad day instead of a bad month
- Test your backups, and keep a copy that attackers can’t reach from your main network.
- Write down your plan, with phone numbers for your provider, insurer, and attorney, and keep a printed copy.
- Use endpoint protection that can contain threats automatically, so an infected laptop is isolated before it spreads.
- Have someone watching. Managed monitoring and a ready incident response team shorten the time between “something is wrong” and “it’s contained.”
Insurers also look for these same preparations, which we cover in cyber insurance requirements for small businesses. If you would like to know how prepared you are today, request a free security snapshot.
This article is general information, not legal advice. If you are dealing with an active incident, contact your incident response provider, insurer, and attorney.