Ransomware encrypts your files and demands payment for their return.
Speed matters. The first hours determine whether you can recover your business.
Contain the attack immediately
Stop ransomware spreading to more systems. Every minute of delay means more encrypted files.
-
Disconnect affected computers from the network
Unplug ethernet cables and disable Wi-Fi on systems showing ransomware signs (ransom message, encrypted files, unusual file extensions). Do NOT turn computers off - this preserves evidence.
-
Disconnect shared drives and cloud storage
Network drives, NAS devices, and cloud sync services (OneDrive, Dropbox) are prime targets. Disconnect them immediately.
-
Isolate backup systems
Disconnect backup storage from the network immediately. Many ransomware variants target backups to prevent recovery.
-
Alert IT support and warn staff
Contact IT immediately. Tell all staff to stop using computers until given the all-clear.
Assess and report
Identify what is affected and report to the relevant authorities.
-
Document affected systems
Check each computer and server for ransom notes, files with unusual extensions (.locked, .encrypted), or files that will not open.
-
Check whether backups are intact
Test backups using a clean computer - do NOT connect backup drives to potentially infected systems.
-
Identify the ransomware variant
The ransom note often identifies the strain. Check nomoreransom.org for free decryption tools.
-
Preserve evidence
Photograph ransom messages. Keep logs of what happened and when. Do not delete files.
Report data breaches to the Information Commission
Ransomware encrypting personal data is a breach under UK GDPR. You may need to notify the Information Commission (formerly the ICO) within 72 hours.
Recovery options
In order of preference:
Restore from backups
- Verify backups are clean before restoring
- Rebuild systems from scratch - ransomware may have left backdoors
- Patch systems before reconnecting to the network
Use a free decryption tool
- Check nomoreransom.org, a legitimate project providing free tools for many ransomware families
- Do not pay for tools from unknown sources - many are scams
Rebuild without your data
- Wipe systems and reinstall. Rebuild data from paper records and other sources
- Painful but sometimes faster than waiting for decryption
The ransom payment decision
The NCSC and law enforcement strongly advise against paying. Understand the risks:
- Criminals may not provide working keys, or may demand more.
- Your payment finances future attacks.
- Organisations that pay are often attacked again.
- Paying a group on a UK sanctions list is a criminal offence.
- Attackers often copy data before encrypting it, so they may sell it anyway.
Sanctions risk
Many ransomware groups are linked to sanctioned entities. Before any payment, check the UK sanctions list and get professional legal and technical advice.
Recovery and prevention
After the crisis, focus on safe recovery and preventing recurrence.
-
Rebuild properly
Ensure systems are clean. Change all passwords. Enable multi-factor authentication. Apply all security updates before reconnecting.
-
Monitor for reinfection
Watch for unusual activity. Attackers may have established persistent access.
-
Conduct post-incident review
How did they get in? What failed? Document lessons and implement improvements.
-
Strengthen backups
Implement offline or immutable backups. Test restoration regularly.
Sector reporting duties
If your firm is regulated by the FCA or PRA, you must notify them of material cyber incidents and follow your operational resilience procedures. NHS organisations must notify NHS England and their Caldicott Guardian, and NIS-designated organisations must report within 72 hours.
Getting help
Consider professional support if you lack IT security expertise, the attack affects critical systems, or you need help with evidence preservation.
The NCSC maintains a list of Cyber Incident Response (CIR) Assured Service Providers, which are vetted companies for incident response. Your cyber insurance may also provide incident response services.
Before an attack happens
If you are preparing before an attack:
- Implement offline or immutable backups and test restoration
- Enable multi-factor authentication for remote access and admin accounts
- Keep systems patched - apply updates within 14 days
- Train staff to spot phishing
- Create an incident response plan
Legal basis
Primary legislation and key regulations
Official guidance
Police Scotland (opens in a new tab)
www.scotland.police.uk · Scotland
FCA operational resilience guidance (opens in a new tab)
FCA
NHS Data Security and Protection Toolkit (opens in a new tab)
www.dsptoolkit.nhs.uk
NCSC incident reporting (opens in a new tab)
GOV.UK
Where to report a cyber incident (opens in a new tab)
NCSC
Cyber Essentials scheme: overview (opens in a new tab)
Publication · GOV.UK
Cyber security guidance for business (opens in a new tab)
GOV.UK
ICO personal data breach guidance (opens in a new tab)
ICO
Report suspicious emails websites phishing (opens in a new tab)
GOV.UK