Ransomware in your SME: what to do and not do in the first hour
Files with strange extensions, a ransom note on the screen and everything grinds to a halt. What you do in that first hour determines how much you lose. A no-nonsense plan: isolate, do not power off, who to call and what to leave alone.
Brian
Co-Founder & CEO
It is Monday morning. Someone in administration opens a folder on the server and every file suddenly has a strange extension. On the desktop sits a ransom note. At that moment, what counts is not what you know about cybersecurity, but what you do in the first hour. In an SME with fifteen employees there is rarely an IT department to catch this, so that first hour lands with you or with whoever happens to discover it. Below: what you do, what you leave alone, and who you notify.
How do you recognise that it is ransomware?
Ransomware rarely announces itself subtly, but the first signs are often mistaken for a slow server or an ordinary outage. In practice:
- Files suddenly get a strange extension or an unreadable name and no longer open, not even with the right program.
- A ransom note appears: a text file in every folder, a pop-up or a changed desktop background with instructions to pay.
- Everything slows down. Encryption puts heavy load on a device and on the network, so the computer and the shared folders barely respond.
- Shared folders on the server or in SharePoint are unreadable for several colleagues at once.
If you see two or more of these signals together, treat it as ransomware. Better a false alarm than an hour lost.
The first hour: step by step
The goal is simple: stop it from getting worse, and preserve traces for whoever has to fix it. Work through the steps in this order.
- Isolate the device. Pull the network cable and switch off the wifi. Ransomware spreads over the network to other computers and to the server.
- Do not power off or restart the device, unless your IT partner explicitly asks you to. The working memory holds traces that are useful for recovery and investigation.
- Take a photo of the screen and of the ransom note with your phone. That is evidence for your insurer and the police, and it helps to identify the variant.
- Call your IT partner. No email, no ticket, call. Every minute the encryption keeps running costs files.
- Have all employees stop working in shared folders and on the server. Leave the device on, open nothing until there is news.
- Disconnect your backup system. An external drive or NAS that is still connected gets encrypted too. A cloud backup that syncs live can also pick up the encrypted versions.
- Do not try to decrypt anything yourself and do not pay. Both decisions come later, in consultation.
What you definitely do not do
In a panic, people do well-intentioned things that make recovery harder. The four we see most often:
- Paying without consultation. Paying does not guarantee you get your files back, and it can have consequences for your insurance. That decision is taken with your IT partner, your insurer and possibly the police at the table.
- Cleaning up the device. Running an antivirus scan, deleting suspicious files or clicking away the ransom note destroys information about how the attacker got in.
- Formatting and reinstalling. It feels like a clean slate, but as long as you do not know how they got in, they simply come back.
- Changing all passwords on that same device. Changing passwords is sensible, but do it from a clean device. Otherwise the attacker reads your new passwords straight away.
Who do you notify, and when?
Besides your IT partner, a few more parties need to be informed quickly. Some notifications are mandatory, others protect you financially.
- Your cyber insurer, as soon as possible. Most policies require notification within a short period. What your insurer expects from you exactly is covered in our post on cyber insurance and evidence.
- The police and the Centre for Cybersecurity Belgium. File a report with your local police and report the incident via Safeonweb. Your insurer will often need the police report.
- The Data Protection Authority, within 72 hours, if personal data is affected. Under the GDPR that is mandatory, and for an SME with customer data, staff files or invoices that is almost always the case.
- Customers and suppliers, if your invoicing or communication is affected. If they risk receiving fake invoices in your name, you warn them yourself, before the attacker does.
The days after, and what you prepare today
After the first hour the real work begins. First the cause is found: which account, which email, which open access. Then the affected devices are reinstalled and your data is restored from a backup taken before the infection. Only then do the devices go back on the network, with MFA on all accounts and all patches installed. Count on a few days to a week, depending on how well your backup was in order.
That is the real lesson: how well the first hour goes is determined by what you arranged months earlier.
- A backup that is offline or disconnected, so ransomware cannot reach it. How to set that up is explained in our post on the 3-2-1 rule.
- A contact list on paper: IT partner, insurer, police. If the server is down, your digital address book is down with it.
- Agreement on who may decide: who shuts down the server, who calls the insurer, who decides about paying. You do not figure that out at three in the morning.
- Half an hour of practice with your team, going through the steps above. That is the difference between panic and a plan.
Not sure whether your backup would pass the test, or who may decide what during an incident? Book a call and we go through your preparation together, before it is needed.