What to do when ransomware hits your small business.

One morning you turn on your computer. Every file has a new extension, a message fills the screen demanding cryptocurrency in exchange for a decryption key. You have just been hit by ransomware.

It is an extremely stressful moment. But there are specific actions to take, and specific mistakes to avoid. This guide walks you through it step by step.

How to recognize an attack in progress

The signs of a ransomware attack are usually unmistakable:

• Files that no longer open or whose extension has changed (for example, “invoice.pdf” becomes “invoice.pdf.locked”).
• A message on screen demanding payment in cryptocurrency.
• Shared network access disappearing one by one.
• An antivirus triggering emergency alerts across multiple computers.

Less commonly, an attack spreads silently for several days before triggering. In that case you may notice unusual access activity or unexplained slowdowns beforehand.

The first steps to take within the hour

Stay calm. That is your best asset. Do not click anything in the ransom message. Do not pay. Act methodically.

1. Disconnect affected machines from the network immediately. Unplug the network cable and turn off Wi-Fi. Ransomware spreads across the network: isolating infected machines limits damage to other computers and servers.

2. Shut down infected machines. Power them down cleanly if possible, or force shutdown. Do not turn them back on without expert guidance.

3. Unplug any connected backup drives. If an external backup drive is connected to an infected PC, unplug it immediately. It may not yet be affected.

4. List the affected machines and data. Note which computers appear infected and which files or folders are affected. This information will be valuable for the expert and for filing a police report.

5. Notify your team. Tell your colleagues not to touch anything and to avoid turning on their machines until the situation is under control.

Who to contact after an attack

Several parties need to be notified promptly.

An IT expert. This is the immediate priority. They can assess the scope of the attack, identify the ransomware variant, and guide you through the recovery process.

Your cyber insurance. If you have a cyber insurance policy or a cyber coverage rider on your business insurance, notify them quickly. It may cover expert fees and business interruption losses.

Law enforcement. File a police report at your local police station or precinct. This report is required for insurance claims and contributes to broader investigations.

Data protection authorities if personal data belonging to customers or employees may have been compromised. Check your local breach notification requirements and timelines.

The role of backups in your recovery

A recent, offline, uncompromised backup is the key to a fast recovery. If you followed the 3-2-1 rule (three copies, two media types, one off-site), your expert can:

1. Clean or reinstall the infected machines.
2. Restore data from the clean backup.
3. Get you back in operation without paying the ransom.

If you have no backup, visit nomoreransom.org: it offers free decryption tools for many known ransomware variants. Recovery is not guaranteed, but this is the first thing to check before considering any other option.

How to reduce the risk going forward

Once the incident is resolved, these are the priority steps:

• Automated and disconnected backups. At least one copy must be offline or in a cloud environment separate from your main network.
• Regular updates. Most ransomware exploits known vulnerabilities in Windows, browsers, or office software. Updates patch those holes.
• Team training. Most infections start with a click on a malicious attachment. Teaching your team to spot suspicious emails is the single most effective measure.
• Up-to-date antivirus on all machines. A good antivirus detects and blocks many known variants.
• Limit admin rights. Grant administrator privileges only to people who genuinely need them.

---

A ransomware attack is a situation where expert help makes a real difference. iokoo specialists can respond quickly to assess the damage, coordinate recovery, and strengthen your defenses. Browse our expert pool or create an account to get help without delay.