Business attacked with ransomware: first steps, containment, and safe recovery

Ransomware is rarely “just encryption”. It is usually a combined incident: stolen credentials, persistence, lateral movement, data exposure, and then a business interruption event designed to force an urgent decision. The first goal is not negotiation. It is containment and evidence so you can recover without guessing.

If you are a small business, treat this like a fire drill with three tracks running in parallel: stop spread, preserve facts, and restore operations safely. Speed matters, but so does sequence. The wrong “quick fix” can destroy logs, overwrite evidence, or reintroduce the attacker during recovery.

First 30 minutes: containment without self-sabotage

• Isolate affected machines: disconnect from network (unplug Ethernet, disable Wi-Fi). Do not start wiping or “cleaning” yet.
• Stop remote access: disable VPN access and remote desktop exposures if you can do so centrally.
• Protect identity first: reset passwords and revoke sessions for admin accounts and primary email accounts from a clean device.
• Preserve evidence: photograph ransom notes, capture filenames, and record timestamps. Do not delete the encrypted files.
• Pause automation: stop scheduled jobs and sync tools that may spread encryption (file sync, backup sync, shared drive mapping).

Do not: factory reset everything, restore from backups, or “clean” endpoints before you know what the attacker still controls. Recovery without containment often becomes a second compromise.

Classify the incident: encryption, theft, or both

Ransomware groups increasingly use double extortion: they steal data and then encrypt. Your recovery choices change based on what happened.

• Encryption-only symptoms: files renamed/encrypted, systems locked, but no evidence of data staging or exfiltration.
• Theft indicators: unusual outbound traffic, large archive files, new admin accounts, remote tools installed, or “we will leak your data” claims that include proof samples.
• Persistence indicators: new VPN users, new device enrollments, suspicious scheduled tasks, or remote management agents you did not deploy.

If you cannot tell, assume both until evidence says otherwise. That is the safer posture for notifications, credential rotation, and customer comms.

The decision points that change outcomes

Containment steps that work in real environments

1) Shut down the attacker’s access paths

• Disable or restrict remote access (VPN, RDP, remote management tools) to known, verified admins only.
• Reset passwords for privileged accounts and any accounts that can access shared drives or email.
• Review admin group membership and remove unknown accounts.
• Revoke active sessions where possible (email, identity provider, VPN).

2) Contain spread across file shares and cloud drives

• Unmap shared drives and temporarily restrict write access to high-value shares.
• Pause sync clients (OneDrive, Google Drive, Dropbox) on affected machines to prevent encrypted files from syncing.
• Check whether cloud storage has versioning you can roll back safely.

3) Preserve evidence before you rebuild

You do not need perfect forensics to be safer, but you do need a basic factual record:

• When did symptoms start, and on which machine?
• Which user was logged in?
• What remote tools were installed?
• What admin changes occurred?

This is the information you will need for insurers, counsel, law enforcement, and to avoid reintroducing the attacker during restoration.

Who to call and in what order

Many businesses lose time by calling the wrong party first. Sequence matters:

• Internal owner: someone who can authorize containment actions quickly.
• IT or managed service provider: to isolate systems and preserve logs.
• Cyber insurance hotline (if you have it): insurers often require notification and can provide vetted incident responders.
• Legal/compliance: if data exposure is possible.
• Law enforcement: where appropriate and where it does not compromise containment.

Rule of thumb: Containment and evidence first. Negotiation second. Public communications last.

Restore operations without re-infecting yourself

Use a clean rebuild lane

Restoring from backup is not enough if the attacker still controls credentials or remote access. Create a clean lane:

• Rebuild critical machines from known-good media.
• Re-join systems to the domain or identity provider after credential resets.
• Patch before reconnecting to the main network.

Validate backups before mass restore

• Confirm backups predate the compromise window.
• Confirm backups are not mounted or writable by normal users.
• Test restore to an isolated environment first.

In many incidents, backups exist but are not usable at the speed the business needs. That is why testing restores is part of security, not just IT hygiene.

Key idea: A ransomware event is an identity incident as much as a file incident. If you restore files but keep compromised admin access, the incident returns.

When data may have been stolen

If exfiltration is likely, you now have two problems: business interruption and privacy exposure. Actions that help:

• Identify which data stores were reachable from the compromised accounts.
• Preserve logs from email, VPN, identity provider, and endpoint tools.
• Prepare for customer-facing guidance on password resets and fraud watch, even if you do not yet know the full scope.

Victim-side view: what to do after a data breach. It is a useful template for what customers need and what attackers do next.

Should you pay or try to decrypt?

Paying does not guarantee decryption, does not guarantee deletion, and can invite repeat targeting. Some ransomware variants have decryptors available, and some do not. A safer approach is to treat decryption as a technical possibility to evaluate after containment, not as the plan.

Two reputable references for validation and next steps:

• US government ransomware guidance: StopRansomware.gov (CISA)
• Decryption resource hub: No More Ransom

Do not “hire a hacker” to fix ransomware

Be careful with “hackers for hire”. Many are scams, and some will make the incident worse by stealing data or introducing new malware. If you need help, use legitimate incident response and forensics professionals with contracts and clear scope.

See do not hire a hacker for the common traps and safer alternatives.

Prevent the repeat: the controls attackers exploit most

After you stabilize, do a fast root-cause sweep. Most small business ransomware paths are predictable:

• Exposed remote access: RDP/VPN without strong authentication or with reused passwords.
• Unpatched edge systems: firewalls, VPN appliances, NAS devices.
• Weak admin hygiene: shared admin accounts, no MFA, no session audits.
• Backups that are writable: backups reachable from compromised credentials.

Hardening companion: how to protect your business from ransomware and how hackers can hurt your business for the broader risk model.

The practical end state is not “never get hit”. It is “when we get hit, we can contain quickly, restore safely, and explain what happened without guessing”. That posture is built from identity control, backup discipline, and rehearsed containment steps.

If you build those now, you reduce both the chance of a ransomware event and the leverage the attacker has if one occurs. You trade panic decisions for controlled recovery, which is the most valuable currency in an incident.