Skip to content

Ransomware recovery: what to do first and which service to call

Published

If ransomware hits your company, disconnect the affected computers from the network immediately, but don't wipe or reinstall them. Call your cyber insurer and your IT provider, report the attack to the FBI or CISA, and check for a free decryptor before considering payment. Then restore from backups that the attackers couldn't reach.

The first hour

  1. Isolate. Unplug network cables and turn off Wi-Fi on every affected computer and server. If you can't disconnect a device, power it down; CISA recommends shutting down only as a last resort, because it erases evidence.
  2. Don't wipe, reinstall or “clean” anything yet. Investigators and recovery teams need the infected systems as they are.
  3. Protect the backups. Disconnect backup drives and check that the backup system and its admin accounts haven't been touched. Attackers often go after backups first.
  4. Take photos of the ransom note and screens. Don't reply to the attackers or open their links.
  5. Talk on a different channel. Assume your email and chat may be watched; use phones.

Who to call, in this order

  1. Your cyber insurer, if you have a policy. Most require notice right away and assign approved lawyers and response firms; using others can put the claim at risk.
  2. Your IT provider or an incident response company (see below).
  3. Law enforcement: report at the FBI's IC3, your local FBI field office or CISA. They may know the group and whether a decryptor exists.
  4. A lawyer, if personal, health or financial data may have been stolen: breach notification deadlines can start running.

Check for a free decryptor

No More Ransom, run by Europol, national police forces and security companies, publishes free decryption tools for many ransomware families. Upload a sample encrypted file and the ransom note to its Crypto Sheriff to identify the variant. It takes minutes and can save the entire ransom.

Should you pay?

The FBI doesn't support paying: there's no guarantee you'll get working keys, data is often leaked anyway, and payment funds the next attack. There's also a legal risk: the U.S. Treasury's OFAC has warned that paying ransoms to sanctioned groups can violate sanctions, even for victims. If your business can't survive without the data, make that decision with your insurer, a lawyer and law enforcement, never alone.

Choosing a ransomware recovery service

Two kinds of companies help, and the difference matters:

  • Incident response (IR) firms investigate how the attackers got in, contain them, remove their access and guide recovery. Insurers have panels of these.
  • Data recovery companies try to recover files. Some honest ones can; others have been caught quietly paying the attackers and charging you a markup, as ProPublica reported in 2019.

Ask any provider, in writing: Will you pay the attackers on our behalf? How will you recover the data? Do you investigate how they got in? A firm that guarantees decryption without explaining how is the warning sign.

Restoring safely

Restore from offline or immutable backups, starting with the most critical systems, on a clean network. Before reconnecting, change every password (starting with admin and email accounts), turn on multi-factor authentication and patch whatever the attackers used to get in. If you restore without closing the door, many victims are hit again within weeks.

After it's over

The controls that stop most ransomware are cheap: MFA everywhere, offline backups you've tested, updates and endpoint protection. They're the first items in our small business security checklist. If you're a financial business, check your notice duties: 72 hours to New York's DFS under 23 NYCRR 500, and 30 days to the FTC under the Safeguards Rule if customer data was taken.

Sources: CISA, “I've Been Hit By Ransomware!” · No More Ransom · FBI IC3 · U.S. Treasury OFAC, updated advisory on ransomware payments (September 2021) · ProPublica, “The Trade Secret: Firms That Promised High-Tech Ransomware Solutions Almost Always Just Paid the Hackers” (May 2019).

Questions people ask

Should I turn off my computers after a ransomware attack?

Disconnect them from the network first: unplug the cable, turn off Wi-Fi. CISA recommends powering devices down only if you can't disconnect them, because shutting down can erase evidence that investigators and recovery teams use.

Should I pay the ransom?

The FBI doesn't recommend paying: it doesn't guarantee your data back and funds more attacks. Paying a group under U.S. sanctions can also be illegal. If you're considering it, involve your insurer, a lawyer and law enforcement first.

Can ransomware files be decrypted for free?

Sometimes. The No More Ransom project, run by law enforcement and security companies, publishes free decryptors for many ransomware families. Identify yours with its Crypto Sheriff tool before paying anyone.

Who do I call first after a ransomware attack?

Your cyber insurer if you have one, because many policies require you to use their approved response firms. Then your IT provider or an incident response company, and report to the FBI or CISA.