Isolate affected systems, activate your incident-response plan, and get qualified help. Coordinate containment across the network, preserve evidence where feasible, report the incident through appropriate channels, and restore only into a clean environment. If attackers may be monitoring your systems, use an out-of-band channel for response communications.
What should you do first after a ransomware attack?
Use your organization’s approved incident-response plan rather than improvising a separate response. CISA’s September 2023 #StopRansomware Guide says a victim organization should follow its approved incident-response plan.
As an Amazon Associate I earn from qualifying purchases.
- Alert the people responsible for the response. Notify leadership and the relevant security, IT, legal, communications, and business-operations teams. Contact your cyber insurer if your policy or response plan calls for it. Coordinate who is authorized to make decisions and issue updates.
- Switch to a safer communications channel if needed. If attackers could be watching email, messaging, or other affected systems, use an out-of-band channel to coordinate. Avoid sharing sensitive response details through channels that may be compromised.
- Start containment promptly. Identify affected devices and network segments and isolate them from wired and wireless networks when that can safely limit spread. Coordinate actions so teams do not reconnect affected equipment or undermine containment.
Do not delay containment while trying to identify the ransomware variant or determine the full scope. Record what you know and what actions have already been taken, then update the response team as facts change.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesHow do you contain ransomware without destroying useful evidence?
Containment is urgent, but the method matters. CISA cautions that powering down a device can destroy volatile-memory evidence. When possible, disconnect affected devices from the network rather than shutting them off, and coordinate the choice with incident responders.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- If multiple systems or network segments appear affected, consider coordinated network isolation; CISA says taking the network offline at the switch level may be necessary in that situation.
- If a device cannot be disconnected from the network, shutdown may be a fallback to stop further spread. Be aware that doing so can lose volatile evidence.
- For affected cloud resources, take volume snapshots for later investigation where appropriate.
- Do not reconnect potentially compromised devices or move them into a recovery network.
Keep a record of the systems isolated, the time of each action, and who authorized it. This helps responders understand the incident timeline without changing systems just to gather details.
What evidence should you preserve?
Ask qualified incident responders to guide collection and coordinate with law enforcement where appropriate. Preserve useful evidence when feasible, prioritizing information that may disappear or be retained only briefly.
Rank #2
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- System images and memory captures
- Relevant system, security, and network logs
- Malware samples and indicators of compromise
- Original ransom notes, messages, emails, and attacker contact details
Avoid altering affected systems solely to collect information. CISA also advises consulting law enforcement about possible decryptors; some ransomware variants may have tools available, but that does not mean a decryptor exists for this incident.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWho should you report a ransomware attack to?
For a U.S. incident, CISA’s guide identifies CISA, a local FBI field office, and the FBI’s Internet Crime Complaint Center (IC3) as reporting or assistance routes. The FBI also directs ransomware victims to IC3. Choose the appropriate route with your response team and preserve the information needed for a report.
Rank #3
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
The FBI IC3 ransomware page asks complainants to provide available details such as:
- Ransomware variant, if known, and the encrypted-file extension
- Cryptocurrency type and address requested by the attackers
- Attacker email addresses and websites or URLs
- Ransom demand amount
- Whether payment was made and, if so, the amount
Do not delay a report because some details are unknown. Preserve original messages and evidence where feasible, and avoid changing affected systems just to fill in a report.
Rank #4
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
When should you notify customers, regulators, or partners?
There is no single notification deadline that applies to every business. Duties can depend on where the organization operates, the type of data affected, its industry, contracts, and other facts. Involve legal counsel and follow the organization’s communications plan to determine whom to notify and when. Keep updates accurate, coordinated, and limited to what is known.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →How should you recover business operations?
Restore in a clean environment only after the compromise is contained. CISA recommends prioritizing critical services and restoring from offline, encrypted backups. A backup should not be treated as clean merely because it is available.
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
- Set recovery priorities. Identify essential services and the systems they depend on, then sequence restoration around business needs.
- Use a recovery environment that is not compromised. Do not reconnect affected devices or introduce them into the recovery network.
- Restore from offline, encrypted backups. Work with responders to confirm the source and recovery process are suitable before bringing services back.
- Keep restored systems isolated until they are ready. Coordinate checks and reconnection with the response team so recovery does not reintroduce the compromise.
- Document the incident and review the response. Record what happened, decisions made, and lessons for the response plan.
Before an incident, CISA recommends regularly testing backup availability and integrity. A backup that has not been tested may not provide a dependable recovery path.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Should your business pay the ransom?
The FBI says, “The FBI does not support paying a ransom in response to a ransomware attack.” Payment does not establish that systems will be restored or that stolen data will be deleted.
Before any decision, involve leadership, qualified incident responders, legal counsel, and your insurer as appropriate. Consult law enforcement about recovery options and possible decryptors. The legality of a particular payment and any sanctions or insurance restrictions depend on the circumstances; get advice specific to your organization rather than assuming payment is permitted or prohibited in every case.
Free tools Windows power users keep installed
One-click scans. No signup required.
How do you choose outside incident-response help?
If your in-house team cannot manage the incident, compare qualified providers against the work your organization needs. Ask about:
- Ability to contain the affected environment and coordinate across systems
- Forensic scope and evidence-handling practices
- How quickly the team can mobilize
- Geographic and sector coverage relevant to your business
- Experience coordinating with counsel and insurers
- Recovery support and the service terms, including scope and responsibilities
Agree on roles, communication channels, and decision authority with the provider before making changes to affected systems.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
