What Should a Small Business Do in the First Hour of a Ransomware Attack?

Every incident is different, and the right steps depend on your systems, your insurance policy and what the attacker did. This guide turns the response checklist in the federal #StopRansomware Guide into a practical first-hour plan for a small office. Use it to build your own written plan before you need it, not as a substitute for professional incident response.

What does a ransomware attack look like in the first few minutes?

Ransomware is malicious software that encrypts files and systems so they cannot be used, followed by a demand for payment. The Cybersecurity and Infrastructure Security Agency (CISA) notes in its #StopRansomware Guide that attackers also often steal data first and threaten to publish it, a tactic called “double extortion.”

Common early signs include:

• Files that will not open, or that suddenly have a new or strange file extension
• A ransom note on the screen or a text file in many folders
• A file server, accounting system or line-of-business application that suddenly stops working
• Security alerts about encryption or unknown programs on several computers at once

CISA warns that a ransomware infection may be evidence of an earlier, unresolved compromise. That is why the first hour is about containing damage and preserving evidence, not getting back to work as fast as possible.

Why does the first hour matter so much?

First-hour decisions affect how far the attack spreads, whether evidence survives, and how insurance and legal requirements are handled. CISA warns that ransomware may follow an earlier compromise. Disconnecting one visibly affected computer does not establish that the rest of the business is safe.

What should you do first? A practical response sequence

Act promptly and follow your approved incident response plan. These are priorities, not deadlines or promised response times. Tasks may overlap. If safe and within your role, disconnect affected workstations from wired and wireless networks. Involve the responsible team before interrupting safety-critical or essential systems. Contact your incident lead using a separate, trusted communications method, and have qualified responders assess backup access and the wider environment. Do not wait for a later step to call for help.

Priority	Step	Who
Immediate	If safe and within your role, disconnect affected workstations from wired and wireless networks. Involve the responsible team before interrupting safety-critical or essential systems. Do not wipe or reset affected devices.	Whoever notices the attack
As safe to do so	Photograph the ransom note and any error messages.	Whoever notices the attack
Immediate	Call your IT provider or incident lead using a separate, trusted communications method, such as a phone call.	Office manager or owner
Responder-led	Have qualified responders decide on wider isolation, critical-service disruption, forensic work and protection of backup infrastructure. Do not make these changes on your own.	IT provider
Early	Call your cyber insurer’s claims or breach line, if you have a policy, and confirm its notice and response requirements.	Owner or designated lead
Alongside response	Start a written timeline and decide how the business will keep running.	Owner and incident lead
As soon as practical	Report to the FBI or CISA.	Incident lead or IT provider

Step 1: Disconnect if safe and within your role, but do not wipe

If safe and within your role, disconnect affected workstations from wired and wireless networks. Involve the responsible team before interrupting safety-critical or essential systems. Wider network isolation, critical-service disruption, forensic work and backup-infrastructure changes are decisions for qualified responders. Do not experiment with switches, servers or backup consoles.

Preserving evidence matters. CISA explains that shutting a device down can destroy evidence stored in memory. Ask your incident lead what to do if you cannot safely disconnect a workstation. Decisions about shutdowns, forensic collection and changes affecting essential services belong to qualified responders. Do not reinstall Windows, run cleanup tools, delete files or change backup-console settings on your own.

Step 2: Call for help using a separate, trusted channel

Call your IT provider or internal incident lead using a separate, trusted communications method, such as a phone call. Do not assume company email or chat is private if those systems may be compromised. If your email may be compromised, do not use it to discuss the response.

Tell them what you saw, when, which devices are affected, and what you have already done.

Step 3: Protect your backups and stop the spread

Backups may also be affected. CISA notes that ransomware can find and delete or encrypt accessible backups. Qualified responders decide how to assess backup integrity, protect backup infrastructure and address identity or cloud compromise. Staff should not sign in to backup administration tools from a potentially compromised computer or make backup-console changes on their own.

Tell your responder about cloud services such as Microsoft 365. Stolen passwords can give an attacker access to email and files even when the office network is offline.

Step 4: Call your cyber insurer

Contact the insurer promptly to confirm approved providers and policy requirements while your incident lead coordinates urgent containment. Some policies have specific notice requirements, and some require you to use approved response, legal or forensic firms. Confirm what your policy requires before hiring outside help. Our guide to cyber insurance requirements for small businesses explains what insurers commonly ask about.

Step 5: Write things down and keep the business running

Start a simple timeline on paper or a device you know is clean: what happened, when, who did what, and which systems were affected. It helps responders, your insurer, law enforcement and your attorney.

Decide how the business keeps operating. Can staff take orders by phone or use paper forms? Who tells employees what to say to customers? CISA recommends preparing holding statements ahead of time so you are not writing them under pressure.

Step 6: Report the attack

CISA’s guide recommends reporting ransomware to CISA, your local FBI field office, the FBI’s Internet Crime Complaint Center or your local U.S. Secret Service field office. Businesses in Nebraska and Iowa can contact the FBI Omaha field office. You can also report to CISA at cisa.gov/report.

The IC3 ransomware page lists the details to include, such as the variant name if known, the encrypted file extension and the ransom amount. CISA also suggests asking federal law enforcement about possible decryptors, which exist for some variants.

Should you pay the ransom?

The FBI does not support paying a ransom. On the IC3 ransomware page, the FBI says paying does not guarantee you will get your data back and encourages attackers to target more victims. Before any payment decision, involve legal counsel, your insurer and qualified responders, including a review of applicable legal restrictions.

Payment questions are business and legal decisions for your attorney, insurer and experienced responders, never a staff member replying to the attacker. Do not contact the attacker in the first hour.

First-hour ransomware response checklist

Print this and keep it with your contact list. CISA recommends keeping a hard copy and an offline version of your response plan, since your computers may be unusable during an attack.

• If safe and within your role, disconnect affected workstations from wired and wireless networks. Involve the responsible team before interrupting safety-critical or essential systems.
• No shutdown, forensic or backup-console changes undertaken on your own; ask the incident lead for direction
• Photos taken of the ransom note and error messages
• IT provider or incident lead called using a separate, trusted communications method, such as a phone call
• Qualified responders deciding how to assess and protect backups, including use of clean administration systems
• Suspected remote-access or account compromise reported to the incident lead for responder assessment
• Cyber insurer contacted and policy requirements confirmed
• Written timeline started on paper or a clean device
• Attorney contacted if customer or employee data may be involved
• Incident lead coordinating reporting and counsel determining other notification duties
• Plan in place for phones, customers and staff while systems are down
• Do not pay or contact the attacker on your own. Discuss any communication or payment decision with your attorney, insurer and qualified responders, including applicable legal restrictions.

What mistakes make a ransomware attack worse?

• Wiping or rebuilding computers right away. This can destroy the evidence responders need to find how the attacker got in and make sure they cannot return.
• Shutting everything off without a plan. Shutdown can destroy evidence stored in memory. Qualified responders should decide whether shutdown or wider disruption is necessary.
• Restoring backups too soon. CISA warns that attackers may leave other malware behind. Restoring onto systems that are still compromised can lead to a second attack.
• Using company email to coordinate. If the attacker can read your email, they can follow your response.
• Waiting to call the insurer. Late notice may complicate a claim, depending on your policy.
• Assuming no data was stolen. Many attacks include data theft. Ask your attorney whether you have notification duties.

What if customer or patient data was involved?

A ransomware incident may trigger notification, contractual and regulatory duties. Involve your legal counsel promptly to determine which requirements apply, who must be notified and when. Reporting to law enforcement does not replace other obligations.

Dental and medical offices should ask counsel about applicable healthcare privacy and security obligations. This guide does not determine whether a particular incident requires notification.

What should a ransomware response plan include?

A ransomware response plan does not need to be long. A few pages people can follow beats a binder nobody has read. NIST’s incident response guide, SP 800-61 Revision 3, ties incident response to the six functions of the NIST Cybersecurity Framework 2.0: Govern, Identify, Protect, Detect, Respond and Recover. For a small business, that comes down to a few practical pieces:

• Who is in charge. Name an incident lead and a backup, and who can approve spending and decisions.
• Who to call. Phone numbers for your IT provider, insurer, attorney, bank and the FBI field office, stored on paper.
• What matters most. A short list of the systems you need first, such as phones, email, accounting or a practice management system.
• How to recover. Where backups live, who can restore them, and when a restore was last tested.
• How to communicate. Prepared messages for staff, customers and vendors.

CISA recommends practicing the plan regularly. A short tabletop exercise, walking through a scenario around a table, can show gaps before an attacker does.

A worked example

Consider a hypothetical Omaha accounting office. An office manager sees a ransom note on a workstation, and shared files will not open.

If safe and within her role, she disconnects the affected workstation from wired and wireless networks. The responsible team is involved before interrupting safety-critical or essential systems. She leaves it powered on, photographs the screen and calls the incident lead using a separate, trusted communications method. Qualified responders coordinate wider isolation and investigate whether backups and remote access are affected. Nobody assumes a backup is safe merely because it is in the cloud.

The managing partner contacts the cyber insurer and attorney while staff use the business continuity plan for customer communications and essential work. The incident lead records actions and coordinates reporting to law enforcement. The sequence depends on the incident, available responders and applicable obligations, not a promised completion time.

The firm does not reply to the attacker. Recovery still takes time, but an isolated, tested backup gives it an option that does not depend on the attacker.

What questions should you ask your IT provider?

• Do we have a written ransomware response plan, and where is the printed copy?
• If an attack starts at night or on a weekend, how do we reach you, and what happens next?
• Can ransomware on our network reach our backups? When did we last test a full restore?
• Which devices have endpoint detection and response, and who watches the alerts?
• Is remote access protected with multi-factor authentication?
• Will you help us run a tabletop exercise at least once a year?

How Cambium Data helps

Preparing for ransomware starts with understanding your systems, responsibilities and recovery options. Explore Cambium Data’s cybersecurity services and backup and disaster recovery services, or tell us about your current setup so we can determine the scope and support required. This guide is general buyer guidance, not a description of a contracted incident-response service or a guarantee of recovery.

Sources

• CISA, #StopRansomware Guide
• CISA, StopRansomware.gov
• CISA, Report a cyber incident
• FBI Internet Crime Complaint Center, Ransomware
• NIST, SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management
• NIST, Cybersecurity Framework 2.0
• Nebraska Legislature, Neb. Rev. Stat. 87-803

Frequently asked questions

Should I turn off a computer infected with ransomware?

If safe and within your role, disconnect affected workstations from wired and wireless networks. Involve the responsible team before interrupting safety-critical or essential systems. Do not assume that shutting down is the next step: it can destroy evidence stored in memory. If you cannot safely disconnect a workstation, contact your incident lead. Shutdowns and wider technical changes are decisions for qualified responders.

Who should a small business call first after a ransomware attack?

Call your IT provider or incident lead using a separate, trusted communications method, such as a phone call. Then contact your cyber insurer if you have a policy, your attorney if data may be involved, and the FBI or CISA.

Can we just restore from backup and move on?

Not right away, but complete forensic certainty is not a prerequisite for beginning recovery. Qualified responders may approve a staged restoration of validated backups in a clean environment, with monitoring for reinfection during and after recovery. They should assess whether remaining attacker access or malicious activity could compromise the recovery. Do not restore systems into an environment that may still be compromised.

Do we have to report ransomware to the government?

Reporting to the FBI or CISA is strongly encouraged and can help with investigation and possible decryption tools, but not every ransomware incident creates a general federal reporting obligation. Certain industries, regulated businesses and contracts have mandatory reporting requirements, and breach notification laws may require notifying affected people. Ask your attorney what applies to you.

TU

Tony Underwood

Founder, Cambium Data

Tony founded Cambium Data in 2009 and still leads the team. A Navy veteran with more than three decades in IT, he helps Omaha businesses run secure, dependable technology and put AI to practical use.

LinkedInsite.tonyunderwood.us