Ransomware Attack? What to Do First

If ransomware hits you, disconnect the affected computer or server from the network right away, do not pay in a hurry, keep the encrypted files and any ransom note, and restore from a clean backup that the attacker could not reach. Ransomware locks your files and demands money for the key. Paying does not guarantee you get your data back, which is why the backup you made before the attack matters most.

What is ransomware, and how is it different from website malware?

Ransomware is malicious software that encrypts your files and demands payment for the key to open them again. You usually notice it through a message on screen and files that no longer open or have strange extensions.

A hacked website is a different problem, although the two get mixed up. Typical website malware injects spam, redirects visitors or steals data. It rarely encrypts anything. Ransomware is mostly a computer and server problem: your laptop, office file server or a server you manage yourself. If you run a site on a VPS or your own server, it can be hit too.

If your problem is a website behaving strangely, read what to do when your website is hacked instead.

What should you do in the first minutes of a ransomware attack?

Imagine you open your laptop on Monday morning and every document ends in a strange extension, with a text file telling you to pay. Do these things, in this order.

1. Disconnect. Unplug the network cable, switch off Wi-Fi, and disconnect external drives and cloud sync. Ransomware spreads through shared folders and connected devices.
2. Do not turn on or wipe other machines until you know what is infected. Leave the affected one as it is.
3. Keep the evidence. Photograph the screen, keep the ransom note and a few sample encrypted files. They help identify the ransomware family.
4. Change passwords from a clean device. Start with email, hosting, banking and your admin accounts. Assume the attacker may have seen saved passwords.
5. Tell the right people. That is your IT contact or host, your bank if payment details are at risk, and the police. Cybercrime can be reported in most countries.

Should you pay the ransom?

Police and security agencies generally advise against paying. There are three reasons: you have no guarantee the key works, you fund more attacks, and you may be marked as someone who pays.

Before deciding anything, check No More Ransom, a free project by Europol and partners that offers decryption tools for some ransomware families. It does not cover everything, but it costs nothing to look. If you are a business, also consider whether paying is even permitted in your situation. Ask a legal adviser; we cannot give legal advice.

Why do off-site backups decide how this ends?

With a clean backup, ransomware becomes an expensive afternoon. Without one, it becomes a business decision under pressure. That is the whole case for backups in one sentence.

But a backup only helps if the attacker could not encrypt it too. Ransomware actively looks for connected drives and network shares. A backup disk plugged in permanently, or a synced folder, can be encrypted along with the rest.

This is the well-known 3-2-1 rule. Add one more habit: keep several versions, so you can go back to before the infection. A single backup that is overwritten every night will copy the encrypted files too, if you notice a day late.

• Daily backups stored off-site, away from your server and your network.
• Several versions kept, not only the latest.
• Backup access protected with its own password and two-factor authentication.
• A test restore at least a few times a year. A backup you never tried is a guess.

What if your website or shop is affected?

If your site runs on shared hosting, the host usually handles the server itself, and your risk is mostly a hacked site, not an encrypted one. If you run your own VPS or dedicated server, you are responsible for its security, and ransomware is possible.

For a site that is already compromised, our hacked website repair starts with a free diagnosis and a fixed price (from €450 excl. VAT), and we back up before every change.

How does ransomware get in, and how do you lower the risk?

The usual door is not a movie-style break-in. It is a phishing email with an attachment or link, a remote-access service with a weak password, or software that has not been updated. That is why the same habits protect against most threats.

• Train yourself and your team to doubt unexpected attachments. We explain how in why phishing is still the number one threat.
• Update operating systems, plugins and server software.
• Use two-factor authentication and never expose remote access without it.
• Give people only the access their work needs.

Planning for the day it goes wrong is part of this. Our guides on preventing and recovering from data loss and on writing a business continuity plan help you decide in advance what happens when something fails.

How can we help?

We can’t promise to undo an encryption, and we won’t pretend to. What we do is stop the problem coming back: daily off-site backups, uptime checks, safe updates with rollback and security scans are part of our website care plans (from €99/month). If something has already happened to your website, contact us for a free first diagnosis.