# What should we do first if we are hit by ransomware?

Disconnect the affected machines from the network, at the switch or by unplugging the cable and switching off Wi-Fi. Keep them powered on if you can, because memory holds evidence, unless you cannot isolate them any other way. Do not contact the attackers or pay anything before taking advice. Call your incident-response provider, your cyber insurer's hotline if you have one, or your national CSIRT. Change administrator passwords from a clean device, check that your backups are intact and disconnected, and start a written log of what you see and do, with times. If NIS2 applies to you, the 24-hour early warning runs from the moment you become aware of a significant incident, so involve whoever handles reporting from the start.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/first-steps-after-a-ransomware-attack

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [What are the steps after a ransomware attack, in order?](https://netsenx.com/en/faq/steps-after-a-ransomware-attack-in-order)
- [Should we pay the ransom?](https://netsenx.com/en/faq/should-we-pay-the-ransom)
- [Should we pay a ransom if the attackers say they copied our data?](https://netsenx.com/en/faq/should-we-pay-if-attackers-say-they-copied-our-data)
- [What is a ransomware negotiator, and should we use one?](https://netsenx.com/en/faq/what-is-a-ransomware-negotiator)
- [How do we find out what data was stolen?](https://netsenx.com/en/faq/how-do-we-know-what-data-was-stolen)