What should we do first if we are hit by ransomware?
Disconnect the affected machines from the network, at the switch or by unplugging the cable and switching off Wi-Fi. Keep them powered on if you can, because memory holds evidence, unless you cannot isolate them any other way. Do not contact the attackers or pay anything before taking advice. Call your incident-response provider, your cyber insurer's hotline if you have one, or your national CSIRTCSIRT: computer security incident response team. The national team to which serious incidents are reported.. Change administrator passwords from a clean device, check that your backups are intact and disconnected, and start a written log of what you see and do, with times. If NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. applies to you, the 24-hour early warning runs from the moment you become aware of a significant incident, so involve whoever handles reporting from the start.
This answer also appears, with more context, here: Incident response
Read next
Related questions
Terms used here
- CSIRT (computer security incident response team)
- The national team to which serious incidents are reported.
- NIS2 (the EU's second Network and Information Security directive)
- The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies.