# What are the steps after a ransomware attack, in order?

Roughly this order, adjusted to your situation. One: isolate affected machines from the network without switching them off, and stop the spread at the switches or firewall. Two: call your incident-response provider, the insurer's hotline and, if needed, a lawyer, and start an incident log. Three: secure evidence and check whether backups are intact and offline. Four: find out how the attackers got in, which systems they reached and whether data left, and assess reporting duties under NIS2 and the GDPR, with their deadlines. Five: decide what to tell staff, customers and partners. Six: remove the attacker, reset credentials and close the way in. Seven: rebuild and restore in priority order from clean backups. Eight: watch closely for weeks and hold a lessons-learned review. NetSenX helps at steps four and eight, with network evidence and continued detection.

FAQ: [Incident response](https://netsenx.com/en/faq/incident) · https://netsenx.com/en/faq/steps-after-a-ransomware-attack-in-order

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/nis2-incident-reporting-deadlines

## Related questions

- [Should we pay the ransom?](https://netsenx.com/en/faq/should-we-pay-the-ransom)
- [Should we pay a ransom if the attackers say they copied our data?](https://netsenx.com/en/faq/should-we-pay-if-attackers-say-they-copied-our-data)
- [What is a ransomware negotiator, and should we use one?](https://netsenx.com/en/faq/what-is-a-ransomware-negotiator)
- [How do we find out what data was stolen?](https://netsenx.com/en/faq/how-do-we-know-what-data-was-stolen)
- [How can we check whether ransomware attackers really stole our data?](https://netsenx.com/en/faq/how-to-check-whether-attackers-really-stole-our-data)