What is a ransomware attack?

A ransomware attack is when criminals gain access to your systems, encrypt files (or lock you out), and demand payment for a decryption key or to prevent data being leaked. Many modern ransomware groups also steal data first (“double extortion”), meaning the risk isn’t just downtime — it can include data exposure, fraud, and reputational damage.

A ransomware incident should be treated as both a technical incident and a business risk. The priority is to contain the spread, protect evidence, understand what has been affected and avoid actions that could make recovery harder.

Do not immediately wipe systems or restore backups without understanding whether the attacker still has access. If ransomware has affected a business environment, involve your IT support provider, cyber security team or incident response support as early as possible.

First 15 minutes: immediate actions

The goal here is to stop the spread and protect evidence.

1. Isolate affected devices immediately

2. Disconnect from the network (unplug ethernet, turn off Wi-Fi).

3. If it’s a server, isolate the host/network segment rather than powering off everything blindly.

4. Do not reboot, wipe, or “factory reset” yet

5. Preserve evidence for investigation and insurance requirements.

6. A rushed wipe can destroy logs that show how the attacker got in.

7. Document what you’re seeing

8. Screenshot ransom notes, file extensions, error messages.

9. Record the time you noticed it and which users/devices are affected.

10. Stop automated spread

11. Disable affected user accounts temporarily (especially admin).

12. If you suspect active encryption across the estate, consider temporarily disabling shared drives.

First hour: assess the blast radius

Now you’re working out what’s impacted and what’s at risk next.

Check:

• Endpoints: which laptops/desktops are encrypted?

• Servers & file shares: are shared drives affected?

• Backups: are backups online/connected and potentially encrypted too?

• Identity: any signs of compromised admin accounts, MFA changes, unusual logins?

• Email / Microsoft 365: forwarding rules, unusual sign-ins, malicious OAuth apps.

• Data exfiltration: evidence of large outbound transfers, new remote tools, unusual VPN activity.

This is where most organisations realise ransomware is rarely “one PC” — it’s often tied to credential theft, remote access, and lateral movement.

What NOT to do (common mistakes)

• Don’t pay immediately. Paying doesn’t guarantee recovery and can encourage repeat attacks.

• Don’t announce details publicly too early. Keep comms controlled until facts are confirmed.

• Don’t restore before containment. If you restore while the attacker still has access, you can be reinfected.

• Don’t assume backups are clean. Backups can be encrypted or poisoned if attackers had time.

Who to contact (and in what order)

Every business will be different, but a sensible order is:

1. Your IT/security provider (or incident response partner)

2. Cyber insurance provider (if applicable) Insurers often require using approved incident-response partners.

3. Law enforcement / reporting routes In the UK, many organisations report cybercrime via Action Fraud and follow NCSC guidance.

4. Legal/compliance support Especially if personal data or regulated data might be involved.

Regulatory considerations (UK)

If there’s a chance personal data is compromised, you may need to assess whether this is a reportable breach (e.g., to the ICO) and whether individuals need notifying. This depends on the type of data, likelihood of harm, and confirmed exposure — not just the presence of ransomware.

(Note: this is general guidance, not legal advice.)