It usually starts with a phone call: "None of the files open." Screens show a ransom note. Shared drives are full of strange file extensions. Business stops.
Ransomware locks (and increasingly steals) your data, then demands payment. Panic leads to mistakes that make recovery harder. Print this guide, share it with your management, and practise it before you ever need it.
Hour 0–1: Contain the spread
- Disconnect affected devices from the network: unplug network cables and turn off Wi-Fi. Isolate affected servers.
- Don't switch devices off unless your incident responders tell you to. Memory can hold evidence, and sometimes encryption keys.
- Disable remote access (VPN, remote desktop) until you understand how the attackers got in.
- Protect your backups: disconnect them from the network immediately, because attackers deliberately target backups.
- Don't delete anything, including the ransom note and encrypted files.
Hour 1–4: Get the right people involved
- Activate your incident response plan and name one person to lead.
- Call specialist incident responders. If you have cyber insurance, call your insurer first; many policies require you to use their approved responders.
- Brief leadership and legal counsel. Data theft may trigger legal obligations under data-protection laws in the UAE, Saudi Arabia, Egypt and elsewhere.
- Use a separate communication channel (phones, a clean messaging group). Assume the attacker can read your company email.
Hour 4–12: Understand what happened
- Which systems and data are affected, and which are still clean?
- How did the attackers get in: a phishing email, an exposed remote-desktop service, an unpatched VPN, stolen credentials?
- Was data copied out before encryption? Many groups now threaten to publish stolen data as well.
- Preserve logs from firewalls, servers, email and cloud services before they roll over.
Hour 12–24: Communicate and plan recovery
- Report the incident to the police and the relevant national cybersecurity authority.
- Prepare honest, simple messages for staff, customers and partners. Silence and rumors cause more damage than facts.
- Plan recovery from clean backups, restoring the most critical systems first, onto rebuilt or verified-clean machines.
- Reset credentials, especially administrator and service accounts, once the attacker's access has been removed.
Should you pay the ransom?
That is a business and legal decision, never a technical one, and it should only be made with legal counsel and your incident responders. Paying does not guarantee you will get working decryption keys or that stolen data will be deleted, and it may expose you to legal and sanctions risks. Organizations with tested, offline backups are in a far stronger position.
Mistakes that make it worse
- Restoring backups before the attacker has been removed, so the network is encrypted again.
- Wiping machines before evidence is collected, losing the answer to "how did they get in?"
- Negotiating with attackers yourself, without experienced help.
- Telling customers "no data was affected" before you know.
The best time to deal with ransomware is before it happens
Most ransomware attacks exploit weaknesses that a network penetration test would find: exposed remote access, missing patches, weak Active Directory settings and accounts without MFA. Combine that with staff awareness, offline backups that are actually tested, and a written response plan.
DABS focuses on prevention: we find the paths attackers would use and help you close them. Book a free scoping call to find out how exposed you are.
