# How do we restore from backup safely after ransomware?

Do not start restoring until you know how the attackers got in and have closed that route, otherwise you restore into a network they still control. Then work in order: rebuild or verify a clean backup server and restore console first, with new credentials; change all administrator and service account passwords, including those used by the backup software; restore systems into an isolated network segment, not straight back onto production; choose a restore point from before the intrusion began, not just before the encryption; scan the restored systems and check for unexpected accounts, scheduled tasks and remote-access tools; and reconnect them step by step while watching their network behaviour. Keep the encrypted originals untouched until you are sure, both as evidence and in case a decryptor becomes available. With NetSenX in place, restored hosts that start regular outbound check-ins or unusual internal connections show up in the alerts.

FAQ: [Backups and recovery](https://netsenx.com/en/faq/backups) · https://netsenx.com/en/faq/how-to-restore-from-backup-safely-after-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [In what order should systems be restored after an attack?](https://netsenx.com/en/faq/in-what-order-should-systems-be-restored)
- [What are RPO and RTO?](https://netsenx.com/en/faq/what-are-rpo-and-rto)
- [Is cloud file sync, such as OneDrive or Dropbox, a backup?](https://netsenx.com/en/faq/is-cloud-file-sync-a-backup)
- [Do we need to back up Microsoft 365 and other SaaS data?](https://netsenx.com/en/faq/do-we-need-to-back-up-microsoft-365-and-other-saas-data)
- [Should the backup system have separate admin accounts?](https://netsenx.com/en/faq/should-backup-admin-accounts-be-separate)