Firewalls and cybersecurity across San Bernardino County. Locally owned and operated, with local support. Call or text (760) 684-4139Sign inRequest service or a quote
WENO Office Solutions

Home > Ransomware protection > First hour plan

RANSOMWARE INCIDENT RESPONSE
What you do in the first hour decides how many days you are down.

Ransomware attack? What to do in the first hour

Files will not open, there is a ransom note on the screen, or computers are locking up one after another. Stay calm and follow these steps in order. They limit the damage, protect your insurance claim and keep your options open.

Call or text now (760) 684-4139Build my recovery plan
⚠ Under attack now? Call first, read later✓ San Bernardino County businesses
1

The short answer

  • Disconnect affected computers from the network right away. Unplug the network cable and turn off Wi-Fi.
  • Do not wipe, reinstall or pay anything yet. Take photos of the ransom note.
  • If you have cyber insurance, call the insurer's breach hotline before hiring anyone. Many policies require it.
  • Call your IT provider, and report the attack to the FBI.
  • Recovery comes from clean, tested backups. That is why the plan has to be written before an attack.
Unplugstop the spread first
Photosof the ransom note
Insurercall before hiring help
FBIreport at ic3.gov

The first hour, step by step

WhenDo this
Minute 1Unplug network cables and turn off Wi-Fi on affected computers. If you cannot tell which ones, disconnect the internet at the firewall.
Minutes 2 to 10Photograph the ransom note and screens. Write down the time and what people saw first.
Minutes 10 to 20Call your insurer's breach hotline if you have cyber coverage. Then call your IT provider.
Minutes 20 to 40Keep everyone off email and shared drives. Use phones, not company email, to talk about the attack.
Minutes 40 to 60Report to the FBI at ic3.gov or the local field office. Check whether backups are still safe and untouched.

What not to do

🚫Do not wipeReinstalling destroys the evidence your insurer and investigators need.
💵Do not pay yetPayment does not guarantee your files back and may be illegal if the group is sanctioned.
📧Do not email about itAttackers are often still reading company email.
💾Do not plug in backupsConnecting a backup drive to an infected network can encrypt it too.

The days after

  • Find the way in: stolen password, phishing email, open remote access or an unpatched device.
  • Clean and rebuild: rebuild infected computers, reset every password and turn on multi factor sign in.
  • Restore from clean backups: oldest clean copy first, checked before it touches the network.
  • Decide on notices: if personal information was taken, notification laws may apply. See data breach reporting laws.
  • Close the gap: fix whatever let them in so it does not happen again.

The plan you want before it happens

  • A one page contact sheet: IT provider, insurer hotline and policy number, bank, attorney, FBI field office.
  • Who decides what, and who talks to staff, customers and the media.
  • A list of critical systems and how long you can be without each.
  • Backups kept offline or immutable, with a test restore done recently.
  • Printed copies kept outside the network, since your files may be locked.

How WENO helps

1. Emergency responseCall or text. We help isolate the damage and preserve evidence, on site or remote.
2. Work with your insurerWe coordinate with your insurer's response team and provide the technical facts they need.
3. Rebuild and restoreClean computers, reset accounts, restore from backups and confirm everything is clean.
4. Close the doorA WatchGuard® firewall, EDR, multi factor sign in and offline backups so it does not happen again.
5. Write the planA one page response plan and contact sheet for your office, tested once a year.

Questions people ask

Should we pay the ransom?

That is a decision for you, your insurer and your attorney. Paying does not guarantee recovery, and paying certain sanctioned groups can break federal law. Clean backups are the way to avoid the question.

Do we have to report it?

Reporting to the FBI is strongly encouraged and helps investigations. If personal information was accessed, California and federal rules may require notices to the people affected.

Should we turn the computers off?

Disconnect them from the network first. Turning them off can erase evidence held in memory, so only power down if you cannot disconnect them.

Ransomware protectionData backupCyber insurance questionnaireData breach reporting lawsWatchGuard firewallsToday's cyber threats
Write the plan before you need it.Under attack now? Call or text (760) 684-4139.
Build my recovery plan

Sources

  1. CISA: StopRansomware
  2. FBI Internet Crime Complaint Center
  3. U.S. Treasury OFAC

General information, not legal advice. Follow your insurer's and attorney's direction during an incident.