A ransomware attack is a race against the clock. The decisions a small business makes in the first 24 hours decide how much data comes back, how much evidence survives and how long the doors stay closed. This guide walks you through what to do from the moment a ransom note appears: isolate, preserve evidence, report, call your insurer, check for a free decryptor and restore safely. A prevention checklist at the end helps you make sure it never happens again.
Ransomware hits organizations of every size. The FBI Internet Crime Complaint Center (IC3) received more than 3,600 ransomware complaints in 2025, and its 2025 Internet Crime Report lists Akira, Qilin, INC/Lynx/Sinobi, BianLian and Play as the 5 most reported variants. The FBI notes those loss figures run low because many victims never report. You can follow the groups behind these attacks on our RansomWatch tracker.
Before you start
- Print this page or open it on a phone that is not connected to your business network.
- Pick 1 person to lead the response and keep a written timeline of every action, with the time and who did it.
- Switch to phone calls or a personal messaging app. Attackers often watch company email to see whether they have been detected, according to the CISA and FBI #StopRansomware Guide.
- Find your cyber insurance policy number and your IT provider’s emergency contact.
Step 1: Isolate infected systems in the first hour
Unplug the network cable and turn off Wi-Fi on every device showing encrypted files or a ransom note. If several systems or a whole office look affected, take the network offline at the switch. Disconnect shared drives, VPN access and any sync tools such as OneDrive or Dropbox so encryption cannot spread to the cloud copies.
Do not power devices off unless you cannot disconnect them. CISA advises that shutting down destroys evidence held in memory, so power down only when disconnecting is not possible. Prioritize isolating the systems your business cannot run without, such as payment, scheduling or patient records.
What success looks like: no infected device can reach the network or the internet, and no new files are being encrypted.
Step 2: Preserve evidence before you clean anything
Photograph the ransom note on every screen it appears on, including any onion address, email address or chat link it lists. Copy the note file itself and 2 or 3 encrypted sample files to a clean USB drive. Do not delete anything, and do not run cleanup tools yet.
Ask your IT provider or a forensics firm to capture a system image and memory from a sample of affected machines. Save firewall, VPN, email and Windows Security logs before they roll over. For cloud servers, take a snapshot of the affected volumes. Investigators, your insurer and law enforcement all rely on this material.
What success looks like: you have the ransom note, sample encrypted files, logs and disk images stored somewhere the attackers cannot reach.
Step 3: Report to the FBI and CISA
File a complaint at ic3.gov and contact your local FBI field office. Report the incident to CISA at cisa.gov/report, which opens CISA’s Incident Reporting System. Include the ransom note, the variant name if the note gives one, payment addresses and when you first noticed the attack.
Reporting costs nothing and does not commit you to anything. The #StopRansomware Guide recommends asking federal law enforcement about available decryptors even if you think you can recover, because researchers sometimes find flaws in a variant’s encryption.
What success looks like: you have an IC3 complaint confirmation, a CISA incident ID and a named contact at your FBI field office.
Step 4: Call your insurer, lawyer and bank
Call your cyber insurance carrier’s claims hotline before you hire anyone. Many policies require you to use approved incident response, legal and negotiation firms, and paying an outside vendor first can put coverage at risk. Ask your insurer to assign breach counsel. A lawyer decides whether the attack triggers state breach notification laws, HIPAA rules or contract duties to customers.
Call your bank to watch for fraudulent transfers, since attackers often steal banking credentials before they encrypt. Be wary of anyone who contacts you offering to recover your data. We have covered a rogue affiliate posing as a recovery firm and a recovery company owner charged with fraud. Work only with firms your insurer or lawyer vets.
What success looks like: you have a claim number, an assigned breach coach or lawyer and a vetted incident response firm on the call.
Step 5: Check No More Ransom for a free decryptor
Go to nomoreransom.org, the free project run by Europol, the Dutch police and security companies. Use the Crypto Sheriff tool to upload 2 encrypted files and the ransom note. It matches them against known decryption tools and gives you a download link and instructions if one exists. The site lists working decryptors for families including Phobos/8Base, Rhysida, Black Basta, Akira and LockBit 3.0.
Run any decryptor on copies of encrypted files, never the originals. If no tool exists today, check back, because No More Ransom adds new keys over time.
What success looks like: you know whether a free decryptor exists for your variant, and you have tested it on copies.
Step 6: Decide on payment with your lawyer, not the clock
The FBI does not support paying a ransom. Payment does not guarantee working keys, and data-theft groups often leak or resell stolen files anyway. Paying a sanctioned group can also expose you to penalties, according to the Treasury Department’s OFAC ransomware advisory. Never contact the attackers on your own. If payment is ever discussed, your lawyer and insurer must handle it.
What success looks like: any ransom decision is made by your lawyer, insurer and leadership in writing, after the facts are known.
Step 7: Rebuild and restore from clean backups
Before you restore, find out how the attackers got in. Ransomware is often the last stage of an older intrusion, so CISA advises hunting for precursor malware and stolen accounts first. Reset every administrator, service and VPN password, and revoke active sessions. Patch the entry point, which is often an unpatched VPN or firewall, as in the Qilin PAN-OS VPN attacks.
Wipe and reimage affected machines rather than cleaning them. Restore data from offline backups in priority order, starting with the systems that keep the business running. Scan restored files before you reconnect anything to the network.
What success looks like: critical systems run on clean builds, all credentials are new and the original entry point is closed.
Prevention checklist
These controls come from the FBI’s 2025 recommendations and the #StopRansomware Guide.
- Offline, immutable backups. Keep at least 1 copy offline or immutable, encrypted and covering all business data. Test a full restore every quarter.
- MFA everywhere. Turn on multifactor authentication for email, VPN, remote access and every admin account.
- Fast patching. Patch internet-facing systems first, especially VPNs, firewalls and remote access tools.
- Least privilege. Remove default passwords, audit admin accounts and give staff only the access they need.
- Network segmentation. Separate critical systems so 1 infected laptop cannot reach everything.
- Endpoint detection and response. Use EDR on every server and workstation, and have someone watching its alerts.
- Phishing training. Teach staff to spot and report phishing and phone pretexts. See our social engineering guide.
- A written response plan. Keep a printed copy with this guide’s steps, contacts and your policy number, and run a tabletop exercise once a year using CISA’s free tabletop packages.
Common mistakes
- Powering everything off. You lose memory evidence. Disconnect first and power down only as a last resort.
- Wiping machines on day 1. Image them first, or you erase the trail that shows how the attackers got in.
- Talking about the attack over company email. Assume the attackers can read it.
- Hiring a vendor before calling the insurer. It can cost you coverage.
- Restoring before closing the entry point. Attackers who still have access will encrypt you again.
- Assuming no leak because you did not pay. Most groups steal data before they encrypt. Plan for notification either way.
Related reading
- What Is Data Extortion? A Complete Guide to Modern Cyber Extortion
- How to Check If an Infostealer Stole Your Passwords and What to Do
- How to Respond When You Receive a Data Breach Notification
- Qilin Ransomware: Threat Actor Profile
- RansomWatch ransomware tracker
Last verified: November 1, 2026
