Ransomware: what to do in the first hour (a small business checklist)

The short answer

If a screen tells you your files are locked and demands payment, the first hour matters more than anything you do later. Get help, write down what you can see, switch off the affected computer and anything connected to it, change your important passwords from a clean device, and don't pay. Then check your reporting obligations and only restore from a backup you know is clean.

This checklist follows the ASD's Australian Cyber Security Centre guidance on the steps to take following a ransomware attack, written for a small business that doesn't have its own IT team on site. Print it, or save it somewhere you can reach if your computers are down.

Is it ransomware?

Ransomware is malware that locks your devices or encrypts your files, then demands a payment, often in cryptocurrency, to give access back or to stop your data being leaked. The ACSC lists these common signs:

• a pop-up or message demanding payment to unlock your files
• files that ask for a password or code before they'll open
• files and folders that have moved or gone missing from their usual place
• files with strange extensions, or names and icons that have changed unexpectedly
• being locked out of devices or accounts, or logins that suddenly don't work

If you're seeing these on one computer, assume others on the same network may be affected too, including the server or network storage where your shared files live.

First, get help

Ransomware is hard to deal with alone, and the ACSC recommends getting an IT professional involved. If you have an IT provider, call them before you do anything else and follow their instructions, because they may want a particular device handled a particular way. If you don't, the ACSC's hotline, 1300 CYBER1 (1300 292 371), is open 24 hours a day, 7 days a week. If anyone's safety is at risk, call 000.

Tell staff to stop using affected computers and not to try fixing things themselves. Restarting, running random clean-up tools or deleting files can destroy information you'll need later.

Record what happened

Before you switch anything off, capture as much as you can, as fast as you can. A photo of the screen on a phone is the quickest way. The ACSC suggests recording:

• when it happened, and which device it happened on
• the ransom message, including any contact details or payment address
• the names of any new or unusual file extensions
• anything you've received from, or sent to, the attackers
• anything else that has changed, and each step you've taken since

These notes help your IT provider, and you'll need them for insurance, bank or legal claims and for any reports you have to make. Some reports may be due straight away to meet legal, customer or insurance obligations, so check that before moving on. If you have cyber insurance, your policy may require you to call the insurer's incident line early.

Contain it: switch off and disconnect

Once the details are recorded, the ACSC's advice is to turn off the infected device by holding down the power button or unplugging it. Ransomware can spread across a network, so turn off other connected devices too, starting with the ones that hold the most valuable information: servers and network storage first, then computers, phones and tablets.

Don't plug in a USB backup drive or reconnect a backup to check it at this stage. A backup that's connected to an infected network can be encrypted too.

Change important passwords from a clean device

Some ransomware also steals passwords, and early on you won't know what was taken. Using a device that wasn't affected, change the passwords for your most important accounts first: email, cloud storage, banking and the business accounts you rely on. Use a strong, unique password for each one and turn on multi-factor authentication wherever it isn't already on.

Don't pay the ransom

The ACSC's advice is clear: never pay. Paying doesn't guarantee you'll get your files back, it doesn't stop the attackers selling or leaking data they've stolen, and it can make you a target again.

If a payment is made anyway, businesses with an annual turnover above $3 million (and those responsible for critical infrastructure assets) must report it to ASD within 72 hours. Smaller businesses can still report the attack, and should.

Report it

Report the attack to ASD through cyber.gov.au. If personal or financial information may have been accessed, you may also need to notify affected customers or a regulator. The ACSC suggests consulting the Office of the Australian Information Commissioner (OAIC) and getting legal advice if you're unsure. If bank details may have been exposed, contact your bank using its official number and ask it to watch for and stop suspicious transactions. Keep every reference number and email.

After the first hour: recover carefully

Recovery takes longer than the first hour, and rushing it is how ransomware comes back. In order:

1. Check backups before using them. A backup stored on an infected device, or connected to the same network, may be infected too. If you're not sure, don't open it.
2. Remove the ransomware. Scan with trusted security software or reset affected devices, and reset every drive and device that was on the network at the time of the attack.
3. Restore only from clean backups. Restoring an infected copy can put the ransomware straight back.
4. Find out how it got in. A phishing email, an exposed remote access service or an unpatched server will be used again if it isn't fixed.

The one-page checklist

For the wall next to the server, or the front of your business continuity plan:

1. Get help: your IT provider, or 1300 CYBER1. Tell staff to stop using affected computers.
2. Photograph the screen and write down the time, device, message and file extensions.
3. Check for urgent reporting or insurance obligations.
4. Switch off the infected device, then other connected devices, servers and storage first.
5. Leave backups disconnected.
6. Change important passwords from a clean device and turn on multi-factor authentication.
7. Don't pay. Report to ASD at cyber.gov.au.
8. Restore only from backups confirmed clean, after the ransomware is removed.

Make the first hour easier, before it happens

The best recovery from ransomware is restoring from a backup the attack couldn't reach. The ACSC also recommends keeping software and devices updated (especially servers and network storage), using multi-factor authentication, giving everyday users standard rather than administrator accounts, turning off Office macros you don't need, and checking what you expose to the internet, such as remote desktop and file shares.

Write down who to call, where the backups are and who can approve decisions, and keep a copy off your computers. If you've never tested a restore, you don't yet know whether your backup works.

How we help

Our EDR and MDR service watches every device for ransomware behaviour, isolates a compromised device automatically and can roll back files an attack has encrypted. Our cloud backup for Microsoft 365, Google Workspace and endpoints keeps a separate, encrypted copy you can restore from, and managed IT services keep patching, accounts and backups looked after month to month.

Want to know how your business would cope? Send us a message or call 08 9250 4554 to book a free, obligation-free IT security audit, and we'll check your backups, device protection and recovery plan.