Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesContain the attack before trying to fix it. Disconnect infected devices, use a clean connection to coordinate the response, involve your IT provider or an experienced incident-response specialist, assess whether personal data was affected, and restore only into a verified clean environment. Do not assume that paying criminals will recover your files or that an NCSC report replaces notifications to the ICO or other regulators.
First actions: contain the ransomware and establish control
Ransomware response is safest when treated as a coordinated incident, not as a routine computer problem. The first objective is to stop the malware moving or attackers retaining access. The second is to create a reliable record so technical, regulatory and business decisions can be made from facts rather than guesses.
As an Amazon Associate I earn from qualifying purchases.
- Disconnect affected devices immediately. Remove wired network cables and disable Wi-Fi and mobile connections on infected laptops, desktops, servers and other endpoints. If a device cannot be isolated normally, physically disconnect it from the network. Follow the NCSC ransomware response and recovery guidance.
- Consider wider isolation. If several systems are infected, encryption is spreading, or the network itself may be compromised, your technical lead may need to disable core network connections or internet access. This can interrupt operations, but leaving a live attack connected can cause greater damage.
- Stop using a suspected-compromised network for coordination. Use a clean device and a separate trusted connection to contact your IT provider, incident-response advisers, insurers, regulators and law enforcement. Do not submit an online incident report from a network you believe the attacker controls.
- Preserve useful evidence. Record when the incident was discovered, which devices or services show symptoms, ransom-note text, unusual account activity, alerts, screenshots and actions already taken. Do not wipe systems before your technical advisers decide what evidence is needed.
- Nominate one incident lead. Give one person authority to coordinate IT, operations, communications and reporting. Keep a dated incident log containing decisions, people contacted, systems affected, working assumptions and facts confirmed later.
Resetting credentials is usually necessary, particularly for administrator accounts, but do it with a recovery plan. An improvised password change can lock responders out of systems or backups they still need. Your technical team should identify safe recovery accounts and reset credentials through a clean process.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Decide whether the attack is a major business disruption
Ask leadership and the technical team whether critical systems or services are unavailable, severely degraded, or likely to be affected. Examples include inaccessible file shares, halted production, unavailable payment or booking systems, disrupted clinical or customer services, or a large number of encrypted endpoints.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
If important operations are impaired, treat the event as a disruptive cyber incident and follow the NCSC operational-impact triage guidance. Activate your business-continuity arrangements, identify the minimum services that must continue, and give staff a clear instruction about which systems they may use. Avoid reconnecting devices simply to test whether they work; testing belongs in the controlled recovery phase.
Bring in qualified technical help
Contact the external IT provider responsible for your environment if you have one. If that provider lacks ransomware investigation and recovery capability, engage a reputable incident-response consultant. The NCSC advises checking a consultant’s reputation and relevant experience, and whether its proposed approach fits your organisation and requirements; its Small Business Guide: Resolve the incident explains the selection issue.
Ask prospective responders questions that expose how they will work, rather than accepting a promise of instant decryption:
| Question to ask | Why it matters |
|---|---|
| What ransomware and incident-response experience do you have in our systems and sector? | Recovery work differs between cloud services, on-premises servers, identity platforms, industrial systems and specialist applications. |
| How will you investigate possible data theft as well as encryption? | Ransomware cases can involve unauthorised access or copying, which changes privacy and notification decisions. |
| What is your clean-rebuild and restoration method? | A file restore is not proof that attacker access has been removed. |
| Who is available during the incident and how are escalations handled? | Out-of-hours decisions may affect containment, reporting and service continuity. |
| What assumptions, access and evidence do you need from us? | Clear requirements reduce delays and prevent responders from taking unsafe shortcuts. |
Keep the incident log even if an external firm leads the technical work. Record what is known, what remains uncertain and when each conclusion was reached. This supports the ICO risk assessment, communications with customers and insurers, and later improvements.
Assess personal data and the ICO reporting deadline
Ransomware can be a personal-data breach even when there is no proof that files were copied. The Information Commissioner’s Office (ICO) ransomware guidance explains that losing timely access to personal data can itself constitute a breach. If attackers accessed or extracted data, that may also be unauthorised access or disclosure.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Identify what personal data was stored on affected systems, whether it was encrypted or unavailable, whether attacker access is evidenced or suspected, and the likely risk to people’s rights and freedoms. Include customers, employees, suppliers, patients, pupils or any other individuals represented in the data. Keep the assessment and your reasoning in the incident record, including where you conclude that notification is not required.
When the 72-hour clock applies
Where the legal threshold for notifying the ICO is met, report the breach without undue delay and within 72 hours of awareness. The ICO’s 2025 small-organisation guidance says the clock starts when the organisation discovers the breach, not when the underlying attack began: 72 hours: responding to a personal data breach.
You can report with the information available and provide additional details later. Do not delay a defensible initial notification while waiting for a complete forensic report. The ICO expects organisations to keep a record and risk assessment even when a breach is not reportable. Its ransomware page notes that this guidance is under review following the Data (Use and Access) Act 2025, so check the current regulator wording before filing.
| Decision point | Action |
|---|---|
| Personal data clearly affected and risk to individuals reaches the reporting threshold | Notify the ICO without undue delay and within 72 hours of awareness; update the notification as facts develop. |
| Personal data may be affected but the risk is not yet clear | Investigate urgently, document the assessment and avoid waiting passively for perfect certainty. |
| No report to the ICO is required | Retain the breach record, evidence and reasons for the decision. |
Report the cyber incident through the right channels
You can use the NCSC’s Cyber Incident Signposting Service when appropriate. An NCSC report does not discharge separate ICO, sector-regulator, contractual or legal duties. If the attack is live and affecting operations, the NCSC small-business response guidance lists a 24/7 phone route at 0300 123 2040; confirm current contact details before calling.
Consider reporting suspected criminal activity to law enforcement, particularly where there is evidence of extortion, fraud, theft or threats to individuals. Coordinate reports through your incident lead so that timelines and technical facts remain consistent. Preserve ransom notes, wallet addresses, email headers, logs and other communications for investigators, subject to advice from your responders.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
Do not treat ransom payment as a recovery plan
The NCSC states: “The NCSC and UK law enforcement do not encourage, endorse or condone the payment of ransom demands.” A payment does not guarantee a working decryptor, complete recovery, deletion of stolen data or an end to the intrusion. Systems still require investigation, credential remediation and rebuilding, and paying can create legal, financial and operational risks.
Recommended Free Tools
Decisions under extreme pressure should involve directors, legal advisers, insurers and experienced incident responders. Do not let a criminal’s deadline replace evidence-based recovery planning. Whether or not payment is considered, continue containment, preserve evidence and assess reporting duties.
Restore systems only in a clean environment
Restoration should prove that both the backup and the destination are safe. The NCSC recovery sequence is deliberately cautious:
- Identify the rebuild boundary. Determine which endpoints, servers, accounts, cloud services and network segments may have been compromised. Assume connected credentials and systems need checking until your investigation establishes otherwise.
- Safely wipe infected devices. Do not simply delete the ransom note or remove a few suspicious files. Rebuild affected machines according to your technical adviser’s plan.
- Reinstall the operating system and required applications. Obtain installation media and software through a clean network. Apply current security updates before reconnecting to production.
- Verify backups before use. Scan and examine the backup set, confirm its date and contents, and check that it was created before compromise. If the destination device is not clean, restoring into it can reintroduce the attacker.
- Restore in stages. Start with a controlled, prioritised service set. Validate accounts, permissions, application integrity and data before expanding access.
- Scan and monitor continuously. Run security scans and monitor network traffic, authentication events and endpoint alerts for signs of continued infection or attacker persistence.
- Reconnect deliberately. Return systems to the network only after the rebuild, patching, credential work and checks for that system are complete. A successful file restore alone does not establish eradication.
Document which backup was used, what was restored, who approved reconnection and what monitoring remains in place. This makes later troubleshooting possible if symptoms return.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Build backups that can survive the next attack
The NCSC’s March 2026 guidance calls up-to-date backups “the most effective way of recovering from a ransomware attack.” A resilient design separates recovery copies from the environment an attacker can reach and proves that restoration works.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
| Backup control | Implementation question |
|---|---|
| Offline or otherwise isolated copy | Can ransomware access this copy using ordinary network credentials? External drives should be disconnected when not actively backing up. |
| Different locations | Is at least one copy stored separately from the primary site or environment? |
| Different solutions | Would a failure or compromise of one backup system leave another usable copy? |
| Restore testing | When did you last restore representative files and a complete critical service, and what failed? |
| Recovery priorities | Which systems must return first, and how much data loss can each business process tolerate? |
Keep multiple copies using different solutions and locations, test restoration regularly and avoid permanently connected USB sticks or external drives. An external hard drive can be one offline copy, but it must not be the sole backup and it does not clean an infected network or recover data by itself. The NCSC’s March 2026 mitigating malware and ransomware guidance provides the backup recommendations.
Communicate without spreading confusion
Give staff a short, controlled instruction: which devices to disconnect, which systems to stop using, how to contact the incident team and where approved updates will appear. Tell customer-facing teams what is known and what remains under investigation; do not speculate about stolen data or promise a restoration time that technical evidence cannot support.
Directors should decide who can approve public statements, regulator notifications and material operational changes. Keep a separate list of decisions that require legal, contractual or insurance advice. Use the incident log as the single factual timeline, updating it when forensic findings replace assumptions.
Common mistakes that prolong recovery
- Leaving an infected laptop connected because it is needed for email.
- Using a compromised network to submit reports or change recovery credentials.
- Paying before understanding whether backups, systems or sensitive data are affected.
- Restoring a backup without checking both the backup and destination for malware.
- Assuming antivirus alone proves the attacker has been removed.
- Waiting for a perfect forensic report before making a required ICO notification.
- Keeping only one permanently connected backup copy.
- Failing to test restoration until the first real emergency.
After operations resume
Complete a structured review with the technical team, leadership and relevant advisers. Establish the initial access route, identify accounts and systems that need hardening, close persistence mechanisms, update response plans and test the revised backups. The NCSC’s Prepare for incidents guidance can help turn lessons into preparation. Recovery is complete only when the business can operate normally with confidence that access has been removed, data obligations have been addressed and a tested, isolated backup strategy is in place.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
