What a ransomware incident can look like

An employee reports that files will not open, unfamiliar extensions appear, or a ransom note is displayed. Another employee may see a suspicious sign-in notice, or a shared folder may suddenly become inaccessible. Sometimes the attack includes theft of data as well as encryption.

Do not assume every strange file error is ransomware. Do treat strong indicators as a potential security incident until someone qualified has checked them.

First: contain the incident without destroying evidence

If a computer appears actively compromised, disconnect it from networks where practical and follow your incident-response plan. This can help limit spread, but an organization-wide response needs someone to assess affected devices, remote-access tools, administrative accounts, and shared systems.

Avoid impulsively wiping, reimaging, or resetting every device. Those actions can remove evidence needed to understand what happened. Also avoid logging into suspected compromised machines with powerful administrative accounts unless a responder determines it is safe.

If business-critical operations are affected, notify the owner or designated decision-maker immediately and bring in the appropriate incident-response help.

Next: establish what is affected

An incident lead should determine the scope as evidence permits:

  • Which devices, servers, and accounts are affected?
  • Are cloud email, file sharing, or remote-access services involved?
  • Is there evidence of information being copied or exfiltrated?
  • Can normal backups be trusted, or could they have been accessed by the attacker?
  • What must keep operating while recovery proceeds?

The answers may change as an investigation continues. Communicate confirmed facts separately from possibilities.

Involve the right outside parties

Depending on your policies and obligations, this may include your cyber-insurance carrier, legal counsel, an incident-response specialist, law enforcement, and affected vendors. An insurer may have specific notification or panel-provider requirements, so review coverage terms before committing to major outside expenses when circumstances allow.

Potential reporting and customer-notification duties depend on what data was involved, contractual obligations, and applicable laws. Do not send a blanket assurance that no information was exposed before that question has been examined.

Can you restore from backups?

Good backups can substantially improve recovery prospects, but restoring everything immediately may reintroduce the attacker if the entry point, credentials, or persistence mechanism remains. Establish a clean recovery environment and reset or replace compromised access as directed by the response team.

Prioritize business functions rather than recovering machines in arbitrary order. For example, a production shop may need job records and the line-of-business application before general office desktops. Verify recovered applications and data before returning them to normal use.

Should you pay the ransom?

Payment does not guarantee that data will be returned, that stolen information will be deleted, or that the attacker will not strike again. It may also create legal and sanctions-related issues. These decisions require qualified legal, incident-response, and insurance guidance rather than a promise from the attacker.

The Federal Trade Commission warns that paying may not result in getting your data back. Build recovery capabilities that do not depend on an attacker's cooperation.

What should be prepared before an incident?

A small business does not need a hundred-page response binder. It should have a short, accessible plan containing:

  1. The owner or incident decision-maker and an alternate contact.
  2. A current inventory of critical systems and support vendors.
  3. Backup locations, restore instructions, and an offline way to reach the people who manage them.
  4. Emergency contact details for insurance, legal support, and key vendors.
  5. A method for communicating if normal email or phones are unavailable.
  6. A process for recording actions, decisions, and the timeline.

Test the plan in a brief tabletop exercise: “Our server and shared files are unavailable when we open Monday. What happens next?” The discussion usually reveals missing contacts, undocumented dependencies, and unrealistic assumptions.

Bottom line: Ransomware response is about containment, trustworthy facts, business continuity, and clean recovery. The cheapest time to clarify those responsibilities is before the incident.