Ransomware and Small Business: What to Do in the First Hour
Nobody plans to be hit by ransomware, and most small businesses have no plan at all. A calm checklist written before the day it happens is worth far more than panic on the day.
Ransomware is malicious software that locks your files and demands payment to unlock them. It usually arrives through a convincing email, a stolen password or an unpatched system, and it can stop a small business within minutes. The good news is that the first hour largely decides how bad the outcome is, and a short plan prepared in advance makes that hour calmer.
Recognise it quickly
Typical signs include files that will not open or have strange new extensions, a note on screen or in folders demanding payment, programs that refuse to start and computers suddenly running slowly. If you see any of these, assume the worst until proven otherwise.
Isolate first
The most urgent job is stopping the spread. Disconnect affected computers from the network by unplugging the cable or turning off wireless. Do not switch them off unless advised, because that can destroy useful evidence, but do keep them offline. Disconnect shared drives and servers if you can do so safely.
Tell the right people straight away
Alert whoever looks after your IT and anyone in the business who needs to stop using systems. Call your cyber insurer if you have one, because many policies include a helpline and have conditions about notification. In the UK, serious incidents can be reported to the police through the national fraud and cyber crime reporting service and to the National Cyber Security Centre, and if personal data is affected you may have a duty to report to the Information Commissioner's Office within 72 hours of becoming aware, so ask for advice early.
Do not rush to pay
Law enforcement advises against paying ransoms. Payment does not guarantee you get your data back, it funds crime and it can mark you as a willing payer. Decisions like this should be taken calmly with expert advice, not in the first panicked minutes.
Protect your accounts
Change passwords for important accounts from a clean device, starting with email, banking and administrator accounts, and turn on multifactor authentication where it is not already on. Attackers often steal passwords before they deploy the ransomware.
Check your backups, carefully
Find out where your backups are and whether they are safe. Do not connect backup drives to an infected network, because they can be encrypted too. A recent backup held away from the main network is the single best defence, and the reason regular, tested backups matter.
Preserve the evidence
Take photographs of ransom notes, record times and keep notes of what happened. This helps investigators, insurers and your own recovery.
Prepare now, so the hour is calmer
Write down who to call, keep a printed copy of key numbers, hold backups offline or in a separate account, apply updates promptly, use multifactor authentication and train staff to spot suspicious emails. K4O5 helps small businesses prepare through managed backups, monitoring and Cyber Essentials support, and we will gladly review your readiness before you ever need it.