Small business ransomware response checklist: what to do in the first hour

Ransomware usually announces itself with a ransom note on screen, files with unfamiliar extensions, or documents that will no longer open. Before declaring an incident, spend a few minutes checking whether the signs are on one machine or several, and whether shared drives or the email system are affected. A single laptop showing a note is a different problem from a file server where every folder has been renamed.

Name one person to lead the response. In a business of 5 to 50 staff that is normally the owner or operations manager, with your IT provider as technical support. Having one decision-maker stops staff from trying their own fixes, which is how evidence gets lost and the damage spreads.

The aim in the first minutes is to stop the encryption reaching more machines. Disconnect affected devices from the network by unplugging the Ethernet cable and turning off Wi-Fi. Leave the device powered on. Shutting down wipes volatile memory, which can hold the encryption process and clues about how the attacker got in, and some ransomware behaves unpredictably on restart.

If you cannot tell which devices are affected, it is reasonable to disconnect the office from the internet at the router and to isolate the file server and any backup device from the network. Accept the disruption. A stopped business for an hour is far easier to recover from than a second wave of encryption across every machine.

Attackers often go after backups before they trigger encryption, so confirm quickly whether yours are intact. Check that any backup drive or cloud backup is disconnected from the affected network and that nobody is restoring from it yet. Restoring too early onto a network the attacker still controls can lose the clean copy as well.

From a device you are confident is clean, such as a personal phone on mobile data or a spare laptop, change the passwords for your Microsoft 365 or Google Workspace administrator, your backup service and your bank. Turn on multi-factor authentication if it is not already enforced. Do not use a machine that was on the affected network for these changes, as a keylogger would capture the new passwords.

If you hold cyber insurance, find the policy and ring the incident line now, within the first hour. Many policies require you to report promptly and to use the insurer's approved incident response firm. Acting alone, for example by paying a ransom or hiring your own specialist first, can put cover for the claim at risk. Most cyber policies include a 24-hour helpline that connects you to forensic and legal support at no extra step.

Contact your IT provider at the same time and tell them the situation plainly, including which devices you have already disconnected. If you have no insurance and no provider, the NCSC's guidance for small organisations is a sound starting point, and a reputable incident response firm certified under the NCSC Cyber Incident Response scheme can take over technical work.

Ransomware is a crime and should be reported. In England, Wales and Northern Ireland report to Action Fraud on 0300 123 2040, or online. In Scotland report to Police Scotland on 101. Reporting creates a crime reference you may need for insurance and helps the National Crime Agency and police track the groups involved. The NCSC also accepts incident reports and publishes ransomware guidance for small organisations.

If personal data may have been accessed, lost or made unavailable, you have a separate legal duty under UK GDPR. A breach that is likely to risk people's rights and freedoms must be reported to the ICO within 72 hours of you becoming aware of it. You do not need the full picture in the first hour, but you should start a record of what data sits on the affected systems, such as customer files, payroll or health information, so the decision can be made quickly. Regulated firms may also need to inform bodies such as the FCA.

From the first minute, keep a single written log recording the time, the action taken and who did it. Include phone calls, the people you spoke to and any decisions, such as the choice not to pay. Insurers, forensic investigators, the ICO and the police will all ask for this timeline, and memory fades quickly under pressure. Keep the log on paper or on a device that is not connected to the affected network.

Tell staff what has happened in plain terms and give them one instruction: do not use the affected systems, do not discuss the incident on social media and refer any customer, supplier or press enquiry to the incident lead. Agree a holding statement for customers and decide how you will communicate if email is down, for example a phone tree or a personal messaging group.