Cyber security and data protection

Respond to a ransomware attack

Emergency response guide for ransomware attacks. Covers immediate containment, recovery options, reporting requirements, and ransom payment decisions. For businesses currently under attack or preparing for potential incidents.

UK-wide
Guide summary

If ransomware attacks your business, disconnect infected devices from the network immediately to stop it spreading. Document affected systems, check backups, and report the attack to authorities like Action Fraud and the ICO. Never pay the ransom without expert advice.

  • Disconnect infected computers from the network at once
  • Isolate backup systems to prevent encryption
  • Alert IT support and warn all staff to stop using computers
  • Document ransom notes and affected files with photos
  • Check backups using a clean computer only
  • Report to Action Fraud (0300 123 2040) for cyber crime
  • Report data breaches to ICO within 72 hours
  • Forward phishing emails to report@phishing.gov.uk
  • Average ransomware downtime lasts 21 days
  • 71% of attacks target small businesses
On this page
UK-wide

Related guides in Compliance & Legal

Report a cyber incident

Emergency response guide for reporting cyber attacks and data breaches. Covers who to contact (Report Fraud, ICO, NCSC, …

Tech Sector Compliance Overview

Comprehensive guide to regulatory compliance for technology businesses - UK GDPR, data protection, online safety, cybersecurity, and sector-specific …

Under attack right now?
  1. Disconnect affected systems from the network - pull cables, disable Wi-Fi
  2. Do NOT turn off computers - preserves forensic evidence
  3. Do NOT pay the ransom - payment does not guarantee recovery
  4. Report immediately to Report Fraud (0300 123 2040) or Police Scotland (101)
  5. Report to NCSC at report.ncsc.gov.uk for technical guidance

Ransomware encrypts your files and demands payment for their return. It is the most acute cyber threat facing UK businesses - the NCSC responds to 35-40 incidents per week, with 71% targeting small businesses.

Speed matters. The first hours determine whether you can recover your business.

1. Contain the attack immediately

Stop ransomware spreading to more systems. Every minute of delay means more encrypted files.

  1. 1

    Disconnect affected computers from the network

    Unplug ethernet cables and disable Wi-Fi on systems showing ransomware signs (ransom message, encrypted files, unusual file extensions). Do NOT turn computers off - this preserves evidence.

  2. 2

    Disconnect shared drives and cloud storage

    Network drives, NAS devices, and cloud sync services (OneDrive, Dropbox) are prime targets. Disconnect them immediately.

  3. 3

    Isolate backup systems

    Disconnect backup storage from the network immediately. Many ransomware variants target backups to prevent recovery.

  4. 4

    Alert IT support and warn staff

    Contact IT immediately. Tell all staff to stop using computers until given the all-clear.

2. Assess and report

Identify what is affected and report to the relevant authorities.

  1. 1

    Document affected systems

    Check each computer and server for ransom notes, files with unusual extensions (.locked, .encrypted), or files that will not open.

  2. 2

    Check whether backups are intact

    Test backups using a clean computer - do NOT connect backup drives to potentially infected systems.

  3. 3

    Identify the ransomware variant

    The ransom note often identifies the strain. Check nomoreransom.org for free decryption tools.

  4. 4

    Preserve evidence

    Photograph ransom messages. Keep logs of what happened and when. Do not delete files.

Report data breaches to the ICO

Ransomware encrypting personal data is a breach under UK GDPR. You may need to notify the ICO within 72 hours.

3. Recovery options

In order of preference:

Option A: Restore from backups (preferred)

  • Verify backups are clean before restoring
  • Rebuild systems from scratch - ransomware may have left backdoors
  • Patch systems before reconnecting to the network

Option B: Use a free decryption tool

  • Check nomoreransom.org - a legitimate project providing free tools for many ransomware families
  • Do not pay for tools from unknown sources - many are scams

Option C: Rebuild without data recovery

  • Wipe systems and reinstall. Rebuild data from paper records and other sources
  • Painful but sometimes faster than waiting for decryption

4. The ransom payment decision

The NCSC and law enforcement strongly advise against paying. Understand the risks:

  • No guarantee of recovery: Criminals may not provide working keys or may demand more
  • Funds crime: Payment finances future attacks
  • Makes you a target: Paying organisations are often attacked again
  • May be illegal: Paying groups on UK sanctions lists is a criminal offence
  • Data may still be sold: Attackers often copy data before encrypting

Sanctions risk

Many ransomware groups are linked to sanctioned entities. Before any payment, check the UK sanctions list and seek legal advice.

NCSC position: Payment does not guarantee recovery and funds further attacks. If considering payment as a last resort, seek professional legal and technical advice first.

5. Recovery and prevention

After the crisis, focus on safe recovery and preventing recurrence.

  1. 1

    Rebuild properly

    Ensure systems are clean. Change all passwords. Enable multi-factor authentication. Apply all security updates before reconnecting.

  2. 2

    Monitor for reinfection

    Watch for unusual activity. Attackers may have established persistent access.

  3. 3

    Conduct post-incident review

    How did they get in? What failed? Document lessons and implement improvements.

  4. 4

    Strengthen backups

    Implement offline or immutable backups. Test restoration regularly.

Professional & Financial Services Requirement

Financial services firms

FCA/PRA-regulated firms must notify regulators of material cyber incidents. Follow your operational resilience procedures.

FCA operational resilience guidance (opens in a new tab)
Healthcare & Social Care Requirement

NHS organisations

Notify NHS England and your Caldicott Guardian. NIS-designated organisations must report within 72 hours.

NHS Data Security and Protection Toolkit (opens in a new tab)

6. Getting help

Consider professional support if you lack IT security expertise, the attack affects critical systems, or you need help with evidence preservation.

The NCSC maintains a list of Cyber Incident Response (CIR) Assured Service Providers - vetted companies for incident response. Your cyber insurance may also provide incident response services.

Before an attack happens

If reading this guide proactively:

  • Implement offline or immutable backups and test restoration
  • Enable multi-factor authentication for remote access and admin accounts
  • Keep systems patched - apply updates within 14 days
  • Train staff on phishing (90% of attacks start this way)
  • Create an incident response plan

Official guidance and reporting