The first hour of a ransomware attack: a checklist for directors

Signs you may be under attack

• Files that will not open, or have unfamiliar file extensions
• A ransom note on screens or in folders
• Systems or servers suddenly slowing down or becoming unavailable
• Staff reporting that they are locked out of accounts

The first hour

This is a general checklist. Your own incident response plan, agreed in advance with your IT provider, should always come first.

• Call your IT provider or incident response contact immediately and tell them what you are seeing.
• Disconnect affected devices from the network (unplug the cable or turn off Wi-Fi), but do not switch them off unless advised. Evidence can be lost.
• Do not delete anything, and do not try to decrypt files or contact the attackers.
• Check whether your backups are safe, and disconnect them from the network if they are not already separate.
• Contact your cyber insurer, if you have one, before engaging other firms. Many policies have a helpline and preferred responders.
• Start a written log: what happened, when, who did what. You will need it later.
• Decide who speaks to staff, customers and suppliers, and keep messages factual.

What comes next

Once the immediate situation is contained, attention turns to recovery, notification and keeping the business trading. If personal data may have been affected, you may need to report it to the Information Commissioner's Office within 72 hours of becoming aware of it. Fraud and cyber crime can be reported to Report Fraud, the UK's national reporting service.

Directors will also face difficult commercial decisions: which customers to prioritise, how to fulfil orders manually and what to tell the bank. These are business decisions, not IT decisions, and they are much easier if they have been thought through in advance.

Prepare now, so the first hour goes to plan

• Write a one-page incident response plan with names and phone numbers, and keep a printed copy.
• Make sure backups are separated from your network and test-restore them regularly.
• Agree with your IT provider exactly what they will do in an incident, and what it will cost.
• Run a short tabletop exercise with the leadership team once a year.
• Decide in advance how key operations, such as production or dispatch, would run without systems for a week.

We are not an emergency response service. We help businesses prepare in advance, so that when something happens, everyone knows exactly what to do and who to call.