What to do in the first hour of a ransomware attack

Recognize what is happening

Ransomware rarely announces itself politely. Staff may notice files with strange extensions, documents that will not open, a ransom note on the desktop or in every folder, or a sudden slowdown as computers encrypt shared drives. Sometimes the first sign is a call from a vendor saying your email is sending odd messages. Whatever the trigger, treat it as an incident from the moment someone raises it.

The person who notices should not try to fix it alone. They should tell their manager and your IT provider immediately, by phone if possible, since email and chat may be compromised or unavailable. Make sure everyone knows who to call after hours, and keep that number somewhere that does not depend on your computers working, such as a printed card or a phone contact.

Contain the spread

The priority is to stop encryption reaching more systems. Disconnect affected computers from the network by unplugging the network cable or turning off Wi-Fi. Do not power them off unless your IT provider tells you to, because memory can hold evidence and sometimes encryption keys. If you are unsure which machines are affected, disconnecting the internet connection at the firewall buys time.

Disable remote access tools and VPN connections until you understand how the attackers got in. If you use cloud file sync, pausing sync can stop encrypted files from overwriting good copies in OneDrive, SharePoint or similar services. Change the passwords of administrator accounts from a clean device, since attackers often hold those credentials already and may try to return.

• Isolate affected devices from the network
• Leave them powered on unless advised otherwise
• Pause cloud sync and remote access
• Protect backup systems from any connection

Protect your backups and evidence

Modern ransomware groups go after backups first, because a business that can restore is less likely to pay. Make sure backup servers and storage are disconnected from the affected network, and do not plug in external backup drives to check them. Your IT provider will verify backups from a clean environment.

Preserve what you can. Photograph ransom notes, write down the time things were noticed, and keep a simple log of who did what and when. Do not delete suspicious emails or wipe machines yet. Insurers, investigators and police will want this information, and rebuilding too early can destroy the trail that shows how the attackers got in.

Make the right calls

Contact your IT or incident response provider first, then your cyber insurance carrier if you have one. Many policies require you to notify the insurer early and use their approved responders, and acting without them can affect coverage. Report the incident to the Canadian Centre for Cyber Security through its online reporting system, and to your local police.

Do not contact the attackers or visit their payment site before speaking to your responders and insurer. Whether to pay is a business and legal decision with no guaranteed outcome, and it should be made with full information rather than in panic. Paying also carries legal risk if the group is subject to sanctions, which your responders and counsel can help you check before any decision is made.

Think about obligations and communication

If personal information may have been accessed, you may have legal duties. Alberta organizations covered by the Personal Information Protection Act must notify the Office of the Information and Privacy Commissioner of Alberta when a breach creates a real risk of significant harm. Federally regulated and some other organizations fall under PIPEDA. A privacy advisor or lawyer can help you assess this quickly.

Decide who speaks for the business. Give staff a short, factual message, tell them not to post about the incident, and prepare a holding statement for clients. Saying little but saying it accurately is better than speculating early. Keep a record of every notification you send and when, because regulators and insurers may ask for it later.