Ransomware
July 2026
· 10 min read
What to Do When Your Business Gets Hit by Ransomware
Ransomware attacks on small businesses have tripled since 2023. If you're reading this because it just happened to you: slow down, don't pay yet, and work through this guide. If you're reading it as preparation — even better. Here's an hour-by-hour response plan written for business owners, not IT teams.
If this is happening right now
Disconnect affected machines from the network immediately — unplug ethernet cables and turn off Wi-Fi. Do not shut down the machines yet. Do not pay anything. Call your IT support or an incident response firm before doing anything else.
Hour 0 — Discovery
Isolate, don't shut down
- Disconnect affected machines from the network (ethernet + Wi-Fi) immediately
- Do not shut down the machines — volatile memory may contain encryption keys
- If you have network-attached storage (NAS) or shared drives, disconnect those too
- Identify which machines are affected vs which are clean
Hour 0–1 — Notification
Alert the right people
- Notify your IT support or managed service provider immediately
- If you have cyber insurance, call them now — many policies require notification within hours
- Brief your management team so decisions can be made quickly
- Do not publicly disclose or post on social media yet
Hour 1–2 — Preserve evidence
Document before you clean
- Photograph ransom notes on screen before doing anything else
- Note the exact time you discovered the attack and which files/systems are affected
- Preserve system logs if accessible — these help identify the entry point
- Note any suspicious activity you remember from the days before (unusual emails, slow systems)
Assess the damage (hours 2–6)
Once the immediate isolation is done, work with your IT support to understand the scope:
- Which systems are encrypted? Map out affected vs unaffected machines and servers.
- Is backup data intact? Check whether backups are affected — ransomware often targets backup systems specifically.
- What data was accessed? Many modern ransomware attacks exfiltrate data before encrypting. This has GDPR implications.
- What strain of ransomware is it? Identify the ransomware variant using ID Ransomware — some older strains have free decryptors available.
Check first: The No More Ransom project (nomoreransom.org) maintains free decryptors for many ransomware variants. Before considering payment, check if your variant is covered.
Should you pay the ransom?
This is the question every business owner faces, and there's no universal answer. Here's how to think about it:
Arguments against paying
- Payment funds criminal operations and encourages future attacks
- In some jurisdictions, paying ransomware groups on sanctions lists may be illegal
- Only ~65% of businesses that pay recover all their data
- Paying marks you as a target who will pay — expect follow-up attacks
When payment might be considered
- Backups are compromised or don't exist
- Data loss would cause greater harm than the ransom amount
- You've confirmed the attacker has functioning decryption keys (ask for a test file)
- Legal counsel and cyber insurance are involved in the decision
Our position
Don't pay until you've exhausted all other options — checked for free decryptors, assessed your backups, and spoken to a professional incident response firm. If you do pay, involve your cyber insurer and legal counsel. Never pay without getting proof the decryption key works first.
Recovery and restoration
Recovery follows a specific order to avoid reinfection:
- Identify the entry point before restoring anything — if you restore to an environment that still has the vulnerability, you'll be hit again within days.
- Rebuild affected systems from scratch where possible — wiping and reinstalling is safer than trying to clean an infected system.
- Restore from the cleanest backup available — ideally an offline or immutable backup that predates the infection. Cloud backup solutions like Backblaze Business Backup maintain version history that helps here.
- Patch everything before bringing systems back online — ransomware frequently exploits known vulnerabilities.
- Reset all credentials — assume all passwords on affected systems are compromised.
Backblaze Business Backup — unlimited, versioned cloud backupThe backup that's actually there when you need it · From $7/user/mo
Prevention: what to put in place now
If you're reading this post-incident, or as preparation, these are the measures with the highest impact against ransomware:
- Endpoint protection with ransomware rollback — Bitdefender GravityZone detects and rolls back ransomware encryption in real time.
- Offline or immutable backups — backups need to be disconnected from your main network. Ransomware specifically looks for and encrypts connected backup drives.
- MFA on all accounts — most ransomware enters via phishing or stolen credentials. MFA blocks this vector even if credentials are stolen.
- Email filtering — malicious attachments and links are the most common delivery method. Browser-level protection like Guardio helps catch these.
- Network segmentation — ZTNA tools like NordLayer limit lateral movement if an attacker does get in.