Ransomware Attack: What Your Business Should Do in the First Hour

It often starts with a phone call or a message from a member of staff: "My files have all got strange names and there is a note on the screen asking for money." Or the whole office arrives on a Monday morning to find nothing works at all.

A ransomware attack is frightening, and the natural instinct is to do something, anything, straight away. Some of those instincts help and some make things worse. This guide sets out what to do in the first hour, who to contact, the reporting duties that apply and how to reduce the chance of it happening again. It is worth reading before you ever need it.

Ransomware is malicious software that encrypts your files and systems so you cannot use them, followed by a demand for payment to unlock them. Many groups now also copy data before encrypting it and threaten to publish it if you do not pay, which is known as double extortion. Attacks are commonly carried out by criminals who rent the tools from others, a model called ransomware as a service.

The UK Government's Cyber Security Breaches Survey 2025/26 found ransomware was reported by 1% of businesses in the previous year. That makes it far less common than phishing, but when it does happen, the impact on a small business can be severe.

The first hour: what to do

1. Stay calm and do not touch the ransom note. Do not click links in it or contact the criminals.
2. Disconnect affected devices from the network. Unplug network cables and turn off WiFi on the affected computers. If you are not sure which devices are affected, disconnect the internet connection to the office. This limits how far the attack can spread.
3. Do not switch devices off or wipe them unless your IT provider or incident responder tells you to. Information in a running computer's memory can be important evidence, and wiping machines destroys clues about how the attackers got in.
4. Call your IT provider. Explain what you are seeing and follow their instructions. If you use our managed IT support, call us on 0191 543 3432.
5. Call your cyber insurer's incident line if you have cyber insurance. Many policies include an incident response team and require you to notify them promptly, sometimes before you appoint anyone else.
6. Protect your backups. Make sure any backup drives still connected are unplugged, and ask your provider to check that cloud backups have not been tampered with.
7. Use a separate way to communicate. If your email or Microsoft 365 might be compromised, use phone calls or personal devices to coordinate, so attackers cannot read your plans.
8. Start a log. Note the time, what you saw, who you spoke to and every decision you make. It helps investigators, insurers and regulators later.

Who to call and report to

Several organisations may need to know. Your IT provider or incident responder can help with most of this, but it helps to know the list in advance.

Reporting to the NCSC does not meet any legal reporting duty you might have, so it is not a substitute for telling the ICO or your sector regulator where required.

Your ICO 72 hour reporting duty

Under UK GDPR, if a personal data breach is likely to result in a risk to people's rights and freedoms, you must report it to the Information Commissioner's Office without undue delay and, where feasible, within 72 hours of becoming aware of it. Ransomware often counts as a personal data breach even if nothing appears to have been stolen, because losing access to personal data, such as staff or customer records, is itself a breach.

If the breach is likely to result in a high risk to the people affected, you must also tell them without undue delay. You do not need to have every answer within 72 hours; you can report what you know and add more detail as your investigation progresses. Whatever you decide, record the breach and your reasoning, as UK GDPR requires you to document all personal data breaches.

Should you pay the ransom?

The UK Government strongly advises against paying. The NCSC points out that paying does not guarantee you will get your data back or that it will not be published, and that it may make you more likely to be targeted again. Payments may also raise legal issues, for example if the recipients are subject to sanctions. The decision ultimately rests with the victim, but it should never be made in a panic. Take advice from your incident responder, your insurer and your solicitor first.

The best way to avoid facing that decision is to be able to recover without the criminals' help.

Why tested backups matter

Good backups are the difference between a business that recovers in days and one that may not recover at all. But attackers know this and deliberately look for backups to delete or encrypt before they strike. A backup that sits on a drive permanently connected to your network, or that nobody has ever tried to restore from, may not be there when you need it.

Your backups should be:

• Separate, with at least one copy offline or immutable, meaning it cannot be changed or deleted for a set period
• Protected by different credentials from your everyday admin accounts
• Comprehensive, covering servers, cloud services such as Microsoft 365 and any line of business systems
• Tested regularly with real restores, so you know how long recovery takes and that it works

Our guide to the 3 2 1 backup rule explains this in more detail, and our backup and recovery service is built around it.

Ransomware prevention checklist

• Multi factor authentication on email, remote access and every cloud service
• Security updates applied promptly on computers, servers, firewalls and other network equipment
• Unsupported software and devices replaced or isolated
• Endpoint detection and response on every device, with someone acting on alerts
• Remote desktop and other remote access never exposed directly to the internet
• Separate admin accounts that are only used for admin tasks
• Email filtering and regular staff awareness training
• Offline or immutable backups that are tested
• A written incident response plan with contact numbers, kept somewhere you can reach it if your systems are down

How Cyber Fits can help

Cyber Fits helps businesses in Sunderland and across the North East reduce the risk of ransomware and recover quickly if the worst happens, through managed security, tested backups and a clear plan for what to do. If you would like to know how your business would cope with an attack today, book a free IT review and we will give you an honest assessment.