What should I do first if ransomware hits my business?

The details

Assume email and chat may be compromised and use phones or a separate account to coordinate. Reset credentials once the attacker’s access is understood, starting with admin accounts.

What to do

• Disconnect infected machines from the network.
• Disconnect and protect backups.
• Call your incident response contact and insurer.
• Report to authorities (for example CISA or the FBI in the US).
• Communicate through a channel the attacker cannot read.

Terms explained

Incident response

Incident response is the organized process of preparing for, detecting, containing, eradicating and recovering from security incidents, then learning from them.

Ransomware

Ransomware is malware that encrypts or steals data and demands payment to restore access or prevent publication.

Sources

• CISA #StopRansomware
• NIST SP 800-61 Rev. 3 Incident Response