Ransomware is malicious software that locks files or systems and demands payment to restore access. Some attacks also steal business data and threaten to publish it.
If you suspect ransomware has hit your business, the first hour matters. Your decisions can affect how far the attack spreads, what evidence remains, and how quickly you recover.
You do not need to understand every technical detail. You need to stay calm, limit further damage, and get the right people involved. Here is a practical checklist for business owners and office managers in Nebraska.
Minutes 0–5: Stay Calm and Confirm the Problem
A ransom message can create pressure to act quickly, but rushing into the wrong action can make recovery harder.
Look for signs such as files that will not open, unusual file names, a ransom note, or several employees suddenly losing access to shared files. Ask employees what they noticed and when the problem began.
Do not assume the attack is limited to the computer displaying the message. Equally, do not assume every system is affected.
During these first few minutes:
Tell employees to stop using affected systems.
Ask staff not to restart computers, install software, or attempt repairs.
Record when the problem was first noticed.
Identify the computers, servers, and shared folders showing symptoms.
Assign one person to coordinate the response and maintain a written timeline.
If you are unsure whether the problem is ransomware, treat it as a potential security incident until someone qualified can assess it.
Minutes 5–15: Disconnect Affected Devices Without Turning Them Off
The immediate goal is to prevent the attack from spreading.
If a computer appears infected, disconnect it from the network. Unplug its Ethernet cable if it uses a wired connection. If it uses Wi-Fi, disable its wireless connection if you can do so safely.
Do not power off the computer just because it displays a ransom note. A running computer may contain useful evidence about what happened. Shutting it down can destroy information held temporarily in memory.
If you cannot safely disconnect a device, contact your IT support provider for instructions. Do not experiment with unfamiliar settings.
If a server or shared storage system appears affected, get qualified help immediately. Disconnecting the wrong equipment can interrupt unaffected operations or complicate recovery.
For a widespread attack, your IT team may recommend isolating additional systems. Follow a coordinated plan rather than having employees unplug equipment at random.
Minutes 15–25: Notify the Right People
Notify your IT support provider or internal IT lead. Explain what you observed, when it started, which systems appear affected, and what actions you have already taken.
If you have a cybersecurity incident response provider, contact that team too. Incident response is the organized work of investigating a security event, limiting damage, and helping the business recover.
Notify the business owner or whoever has authority to make operational decisions. Keep the initial communication factual. You do not need to know the cause before reporting the incident.
Use a phone or another communication method you believe is safe. If your normal email or messaging system might be compromised, avoid using it for sensitive response discussions.
Depending on the incident, you may need legal counsel or your cyber insurance contact. If personal, financial, or regulated information may have been exposed, seek legal guidance promptly to determine what reporting obligations apply.
Minutes 25–35: Preserve Evidence
It is tempting to delete the ransom note, clean up the computer, or remove suspicious files. Resist that urge.
Evidence can help determine how the attacker gained access, which systems were affected, and whether information was stolen.
If practical, photograph the ransom note or take a screenshot without clicking links or interacting with suspicious files. Record the message, any stated deadline, and the contact instructions. Do not reply to the attacker.
Write down the timeline. Include when employees first noticed the problem, which devices displayed symptoms, and which systems were disconnected.
Keep relevant emails, security alerts, and other records. Do not delete logs or reinstall software before your IT or incident response team has assessed what needs to be preserved.
Use a separate, trusted device to search for assistance or communicate with responders. Avoid using an infected computer for those tasks.
If you suspect data was stolen, do not make public claims about the scope of the incident before the facts are established. Record what you know and distinguish it from what you suspect.
Minutes 35–45: Check Backup Status Without Risking the Backups
Backups are copies of business data that can be restored after a problem. They may be essential to recovery, but not every backup is safe to use after ransomware.
Some attacks attempt to damage backups before encrypting business files. Older backup copies may also contain compromised files.
Ask your IT team which backups exist, when they last completed successfully, and whether they are separate from the affected environment.
Do not immediately reconnect backup drives or start restoring files. If the original attack remains active, restored systems could be compromised again.
The recovery team should identify a known-good backup, meaning a copy believed to be unaffected. It should then develop a controlled restoration plan and check restored systems before employees resume normal work.
If reliable backups are unavailable, do not assume recovery is impossible. A qualified response team may identify other options.
Minutes 45–60: Decide Whether You Need Outside Help
By now, you should have an initial picture of the incident, a record of your actions, and a list of the people involved.
Call an outside incident response specialist if multiple systems are affected, servers are encrypted, backups appear damaged, sensitive information may have been stolen, or your IT team cannot establish what happened.
Outside help is also appropriate if the business cannot operate safely or you suspect an attacker still has access.
If you have cyber insurance, follow its notification requirements. Some policies specify how incidents must be reported or which providers can be used. Notify the appropriate contact promptly while continuing urgent containment.
Do not pay the ransom or respond to the ransom note during the initial response. Payment does not guarantee that files will be restored or stolen information deleted. Consider any payment decision later, with qualified cybersecurity, legal, and insurance guidance.
Before the first hour ends, establish who is leading the response, which systems are isolated, what evidence has been preserved, and who will decide the next recovery steps.
What Happens After the First Hour?
Containment is only the beginning. The next steps include investigating how the attacker gained access, identifying affected systems, determining whether data was stolen, and deciding what can safely be restored.
Before systems return to normal operation, address the original weakness. That may involve securing compromised accounts, removing unauthorized access, fixing exposed systems, and checking restored equipment.
Document the incident and review what could reduce the impact of another attack. The goal is to improve the business’s readiness, not assign blame.
For Nebraska businesses, preparation makes the first hour easier. Know who to call, understand where your backups are, and establish an incident response plan before you need one.
Frequently Asked Questions
Should I turn off a computer displaying a ransom note?
Generally, leave it running unless a qualified responder directs otherwise. Disconnect it from the network if you can do so safely, and preserve its current state for investigation.
Should I pay the ransom?
Do not decide during the initial response. Payment does not guarantee recovery or prevent stolen information from being disclosed, so seek qualified cybersecurity and legal guidance.
Can I restore files from my backups immediately?
Not until the backups and affected systems have been assessed. Confirm the backup is usable and the original compromise has been addressed before restoring operations.
Need help? Get free quotes from a local Nebraska team.
Leave a Reply