Ransomware Response: What to Do When You’re Attacked

February 27, 2026 2 min read

Ransomware Response Guide

Ransomware strikes fast and demands quick decisions. Having a response plan ready helps you minimize damage and recover faster.

Immediate Actions (First Hour)

1. Contain the Spread

  • Disconnect affected systems from network
  • Don’t power off (preserve evidence)
  • Isolate network segments
  • Disable shared drives

    • 2. Assess the Situation

  • Identify ransomware variant if possible
  • Determine scope of encryption
  • Check backup integrity
  • Document what you know

    • 3. Activate Response Team

  • Incident response team
  • Executive leadership
  • Legal counsel
  • Communications team

    • Investigation Phase

    Determine Entry Point

  • Phishing email?
  • Exploited vulnerability?
  • Compromised credentials?
  • Third-party access?

    • Assess Scope

  • Systems affected
  • Data encrypted
  • Backup status
  • Data exfiltrated?

    • Recovery Options

    Restore from Backups

    The preferred option if backups are:

  • Recent and complete
  • Not encrypted by ransomware
  • Tested and functional

    • Decryption Tools

    Check for available decryptors:

  • No More Ransom project
  • Security vendor tools
  • Law enforcement resources

    • Paying Ransom (Not Recommended)

    Reasons to avoid:

  • No guarantee of decryption
  • Funds criminal operations
  • May be illegal (sanctions)
  • Makes you a future target

    • Post-Incident

  • Identify and fix root cause
  • Improve detection capabilities
  • Update backup strategies
  • Document lessons learned
  • Consider law enforcement report

Contact our team for incident response.

Need help with endpoint security for your organization? Contact our team.