Ransomware Response Checklist for Businesses

✅ What to do

Disconnect the affected computers and servers from the network (cable and Wi-Fi), and leave them switched on.
Also disconnect any backup drives and units that are still connected to the network.
Tell the person in charge of IT straight away, and choose one person to coordinate the incident.
Write down when the attack was detected, which machines are affected and what was being done.
Photograph the ransom note and any messages on screen.
Find out which backups exist, where they are and when the last one was made.
Contact specialists before restoring, reinstalling or negotiating.

Do not pay the ransom as a first option: paying does not guarantee you get the files back.
Do not delete the ransom note or the encrypted files: they are needed to identify the variant.
Do not format or reinstall the affected servers.
Do not restore backups onto the network without first checking that they are clean.
Do not run decryption tools downloaded from the internet without advice: the wrong tool can damage the files.
Do not switch off or restart the affected machines. Switching them off loses the information held in the machine's memory, which can be key to analysing the attack and recovering the files. Disconnect them from the network and leave them on until you have spoken to a specialist.
Do not contact the attackers on your own.