What to Do in the First 24 Hours After a Ransomware Attack
Short answer: Disconnect the infected device from Wi-Fi and wired networks, do not pay the ransom right away, and call your IT provider or security team. Then check whether your backups are clean and isolated from the attack, document everything with screenshots and timestamps, consider reporting to the FBI's IC3, and give your team and customers a short, honest update.
Ransomware Doesn’t Wait, and Neither Should You
A ransomware attack is one of the most stressful moments a business owner can face. Files are locked, a ransom note appears on screen, and every minute of downtime costs money and customer trust. What you do in the first 24 hours makes the biggest difference in how quickly, and how safely, your business recovers.
I’ve gotten that call at 11pm before, a business owner staring at a ransom note, asking if they should just pay it to make it go away. The businesses that recover fastest are never the ones improvising in that moment.
Joe Engelking, Owner
Step 1: Disconnect, Don’t Panic
The moment you suspect ransomware, disconnect the affected device from your network, both Wi-Fi and any wired connections. This is the single most important early step, since ransomware often spreads to other devices and shared drives on the same network. Isolating the infected machine can stop the damage from getting worse while you figure out next steps.
Step 2: Don’t Pay the Ransom Right Away
It’s tempting to pay immediately to make the problem disappear, but paying doesn’t guarantee you’ll get your data back, and it can mark your business as an easy target for future attacks. Before considering payment, find out whether your data can be restored from backups, and get an experienced IT team involved to assess your actual options.
Step 3: Call Your IT Provider or Security Team
This is the point where a managed IT partner earns their keep. An experienced team can determine how the attack got in, whether it has spread to other systems, and whether your backups are clean and usable for recovery. Trying to handle this alone, without the right tools or experience, often leads to bigger mistakes, like wiping systems before evidence is preserved or restoring from backups that are also compromised.
Step 4: Assess Your Backups
If you have secure, regularly tested backups that weren’t connected to the infected network, you’re in a strong position to recover without paying anyone. This is exactly why backup strategy matters so much before an attack ever happens. Backups that are only stored on the same network as your live systems are often encrypted right along with everything else.
Step 5: Document Everything and Consider Reporting It
Take screenshots of ransom notes, note the time the attack was discovered, and keep a record of every step taken. Depending on the nature of your business and the data involved, you may also want to report the incident to the FBI’s Internet Crime Complaint Center (IC3) and, if customer data was affected, understand your notification obligations under South Carolina law.
Step 6: Communicate Honestly With Your Team and Customers
Employees need clear instructions about what systems are safe to use. If customer-facing systems are affected, a short, honest update goes a long way toward preserving trust, far more than silence or vague statements once the issue becomes noticeable.
The Best Ransomware Response Starts Before the Attack
The businesses that recover fastest from ransomware are the ones that already had a plan: tested backups, monitored networks, and a support team who could be reached immediately. If your business doesn’t have that in place yet, now is the time to build it, not during an active attack.
At The Computer Guyz IT Services, we provide Charleston businesses with 24/7 support and a one-hour response time to any issue, along with proactive monitoring and secure backup systems designed to prevent ransomware from ever becoming a crisis. If you’re concerned about your current setup, contact us for a free IT assessment.
Frequently Asked Questions
What is the first thing to do when ransomware hits?
Disconnect the affected device from your network, both Wi-Fi and wired connections, since ransomware often spreads to other devices and shared drives on the same network.
Should we pay the ransom?
Not right away. Paying does not guarantee you will get your data back, and it can mark your business as an easy target for future attacks. First find out whether your data can be restored from backups, and get an experienced IT team to assess your options.
Can we recover without paying?
Yes, if you have secure, regularly tested backups that were not connected to the infected network. Backups stored only on the same network as your live systems are often encrypted along with everything else.
Should we report a ransomware attack?
Consider reporting it to the FBI's Internet Crime Complaint Center (IC3). If customer data was affected, understand your notification obligations under South Carolina law. Keep screenshots of ransom notes and a record of every step taken.
How fast can The Computer Guyz respond?
We provide Charleston businesses with 24/7 support and a one-hour response time to any issue, along with proactive monitoring and secure backup systems.