How to Recover from a Ransomware Attack: 10 Steps
A plain guide for small businesses, in the order that matters. Steps 1 to 5 are for the first hours. The rest come once the attack is contained.
Jump to: The first hours Backups Paying Rebuilding Afterwards
Step 1. Cut the infected machines off the network
Unplug the network cable and switch off Wi-Fi on every computer or server showing signs of the attack. If you cannot tell which ones are affected, disconnect the office internet connection at the router.
Leave them switched on. Shutting down wipes the computer's memory, which can hold clues to the strain and sometimes even the encryption keys. Unplug the network, not the power.
Unplug backup drives and NAS units that have not been hit yet, and pause any cloud sync, so the encryption cannot spread to them.
Step 2. Confirm it is ransomware and find out which one
The signs are a ransom note on the desktop or in every folder, files with a new extension that will not open, or a lock screen asking for payment. Photograph the note. Its wording, the file extension and the contact address identify the strain, and a free site such as ID Ransomware can match them.
The strain matters. It tells you what the attackers usually do next, whether they also steal data, and whether a free decryptor exists on No More Ransom.
Step 3. Bring in the right people
- Your IT provider, or us on (213) 986-4855
- Your cyber insurer, straight away: most policies set a short deadline for reporting, and some name the response firms you must use
- A lawyer, if customer, patient or employee data may have been taken
- The owner or management, who will have to make the decisions below
Use phones or personal email to coordinate. Assume the company email and chat may be watched.
Step 4. Keep the evidence
Before anything is cleaned, wiped or restored, the affected disks should be imaged and the logs saved: firewall, server, remote access and email. That evidence shows how the attackers got in and what they touched, and insurers and investigators may ask for it. It is also what lets a ransomware recovery lab work on the data later.
Step 5. Report the attack
In the United States, report to the FBI at ic3.gov and to CISA at cisa.gov/report. Reporting is free and does not hand control of your systems to anyone. Law enforcement sometimes holds keys or intelligence for a strain. If personal data was exposed, California and federal rules may require you to notify the people affected; take legal advice on that.
Step 6. Check what your backups can really do
This step decides the rest. Find out whether there is a copy the attackers could not reach: an offline drive, an immutable cloud backup, a copy at another site. Check its date and test-restore a few files on an isolated machine before relying on it.
- Clean, recent backup: you can rebuild without paying. Go to step 8.
- Backups encrypted or deleted too: stop all writes to the backup storage. Encrypted virtual machines and backup files can often still be rebuilt in a lab.
Step 7. Do not rush the ransom decision
The FBI advises not to pay. Payment does not guarantee a working decryptor, decryption is often slow and incomplete, stolen data may be published or sold anyway, and paying marks the business as one that pays. Payments to some groups can also break sanctions rules. If the question comes up, decide it together with management, your lawyer and your insurer, and not under the deadline on the note.
Step 8. Rebuild from clean systems
Do not try to clean infected machines and carry on. Wipe them and reinstall from known-good media, then restore data only from backups you have confirmed are clean. Start with what the business cannot run without, such as the domain controller, email and accounting, and keep rebuilt machines on a separate network until they are checked.
Reset every password: administrator accounts, email, remote access, cloud services and any account the attackers may have created. Turn on two-step sign-in as you go.
Step 9. Scan before anything reconnects
Run a full security scan on each restored machine and check for new user accounts, scheduled tasks and remote access tools the attackers may have left. Reconnecting one missed machine can start the whole thing again.
Step 10. Find the way in and close it
Most small-business attacks start in one of a few places: a phishing email, a stolen or reused password, remote desktop open to the internet, or an unpatched firewall or VPN. Find which one it was and fix it, then update your plan with what you learned. Our ten layers of ransomware protection and security checklist are a good place to start.
How long does recovery take?
It depends almost entirely on the backups. With a clean, tested backup, a small office can be working again within days. Without one, rebuilding and recovering data can take weeks. Acting quickly on the first five steps shortens it either way.
Questions
Should I turn the computer off?
No. Disconnect it from the network and leave it on. Turning it off can destroy evidence held in memory.
Can I just restore from last night's backup?
Only after the attack is contained, the way in is closed and the backup is confirmed clean. Attackers are often inside the network for days before they encrypt, so a recent backup can contain their tools.
Is there a free decryptor?
For some older strains, yes. Check No More Ransom with the strain name. For most current strains there is none, and recovery comes from backups or from the data itself.
Do I have to report it?
Reporting to the FBI and CISA is voluntary for most small businesses but recommended. Notifying people whose personal data was exposed can be a legal duty. Ask a lawyer.
Need help now?
Call (213) 986-4855. We help businesses anywhere in the United States, Canada and Central and South America, remotely from the first hour, and our ransomware lab, run with Recoveo, recovers encrypted servers, virtual machines and backups.
Start a ransomware case Ransomware response
Based on guidance from CISA's #StopRansomware Guide and the FBI. This page is general information, not legal advice.