Hit by ransomware? What to do in the first 24 hours

When ransomware hits, everything seems to stop at once. Screens freeze, files disappear or change extension, and a message demands payment. The first hours matter most. Calm, ordered action limits the damage, protects your evidence and gets you back to work faster.

This guide gives UK businesses a practical plan for the first 24 hours, explains who you may have to tell, and shows how to make sure it does not happen again. If you are dealing with an attack right now, skip to the first section and call your IT provider.

Key takeaways

• Isolate first. Disconnect affected devices from the network straight away to stop the spread.
• Do not wipe or reinstall yet. Evidence about how the attackers got in is valuable, and recovery should follow a plan.
• Paying is not a fix. It gives no guarantee you will get your data back, funds criminals and can create legal risk.
• Know who to tell. Your insurer, the ICO if personal data is involved (within 72 hours of becoming aware), and Action Fraud.
• Backups decide how bad it is. Offline, off-site and tested backups turn a disaster into an inconvenience.
• Prepare before it happens. A written response plan, multi-factor authentication, patching and endpoint protection stop most attacks.

What is ransomware and why is it so common?

Ransomware is malicious software that locks or encrypts your files until you pay. It began as crude digital blackmail but is now a well-organised criminal industry that targets every sector, including small businesses.

• Ransomware-as-a-service means criminals can rent ready-made attack kits, so you do not need technical skill to launch an attack.
• Cryptocurrency makes payments harder to trace.
• Remote work has widened the attack surface through weak passwords and exposed devices.
• Double and triple extortion is now common. Attackers steal your data first, then threaten to publish it or contact your customers as well as encrypting your systems.

How do ransomware attacks happen?

Most attacks start quietly, and many victims do not notice until files begin to lock. The usual routes in are:

• Phishing emails, such as fake invoices, HR notices and parcel messages.
• Exposed remote access, especially remote desktops with weak passwords and no multi-factor authentication.
• Unpatched software, where known flaws in servers, firewalls or applications are left open.
• Stolen passwords, reused from other breaches or captured by malware.
• Malicious downloads, including fake updates and cracked software.

After getting in, attackers typically spend time exploring the network, looking for administrator rights and backups before they encrypt everything. That is why quick isolation matters.

What should you do in the first hour?

1. Isolate affected devices. Unplug the network cable and turn off Wi-Fi. If you cannot isolate a device from the network, switch it off rather than letting the infection spread, but do not wipe or reinstall anything.
2. Raise the alarm. Tell your IT provider or support contact immediately, and tell your team not to log in to or use affected machines.
3. Do not pay, and do not reply to the attackers yet. Make no decision on payment in the first hours. Take advice first.
4. Protect your backups. Disconnect backup drives and cloud backup access that might be reachable from infected machines, so backups cannot be encrypted too.
5. Photograph the ransom note. Take a photo or screenshot of the message and any file names. It helps investigators.
6. Change critical passwords from a clean device. Reset administrator, email and cloud passwords from a machine you know is not infected.

What should you do in the next 24 hours?

1. Find out what was hit. Which systems, accounts and data were touched, and how the attackers got in. A specialist can work this out from logs and the machines themselves.
2. Tell your insurer. Cyber insurance policies often require prompt notification and may include access to incident response specialists. Check your policy before you take action that could affect cover.
3. Check whether personal data is involved. If customers' or staff members' data was accessed or stolen, you must assess whether the breach is likely to put people at risk. If it is, UK GDPR requires you to report it to the ICO within 72 hours of becoming aware of it. The clock starts when you become aware, not when your investigation ends.
4. Report the crime. Report the attack to Action Fraud, the UK's national reporting centre for fraud and cyber crime, using the current route on the Action Fraud website.
5. Get legal and forensic support if needed. Specialists can preserve evidence, advise on reporting duties and help with communications.
6. Tell the people affected, when required. If the breach is likely to be a high risk to individuals, you may also need to inform them directly and without undue delay.
7. Plan recovery. Rebuild from clean systems, restore from trusted backups, reset all credentials and fix the weakness that let them in before you reconnect.

Should you pay the ransom?

Law enforcement and the National Cyber Security Centre advise against paying. Payment does not guarantee that you will get your data back or that it will not be leaked, it marks you as a target who pays, and in some cases it can create legal risk, for example if the group is subject to sanctions. Seek specialist advice before any decision. Recovering from good backups is the safest route.

What are the real-world impacts?

The cost of ransomware goes well beyond the ransom.

• Financial: emergency recovery, downtime, lost sales, legal and forensic fees and rebuilding systems.
• Operational: phones, booking tools, file servers and email can all be unavailable for days.
• Reputational: customers lose patience when services go dark, and trust takes months to rebuild.
• Other consequences: staff stress, regulatory attention, equipment held for forensics and disputes with insurers.

Case study: a building management company with no backups

A building management company came to us after being hit by ransomware. Their files were locked and systems frozen. They had no backups and no recovery plan, so the first job was recovering whatever data we could from what remained. Because it was a small operation with limited IT structure, we planned the entire fix from scratch so that it would not happen again.

We recommended:

1. A new laptop, to separate work and personal use.
2. Remote monitoring and management (RMM), for round-the-clock oversight.
3. Antivirus with endpoint detection and response (EDR), for real-time detection.
4. Scheduled backups with bare metal recovery (BMR), which restores a whole machine after a failure.

Full disaster recovery restores everything with one click, but it costs more each month. Bare metal recovery gave the same end result, just more manually and more slowly, at a price that suited a small budget. The lesson: cloud storage alone is not a backup. You need recoverable backups that get you running again quickly. Read the full story in our ransomware recovery case study.

How can you prevent ransomware?

The best way to survive an attack is not to be an easy target. These basics block most attacks.

• Back up properly. Keep at least one copy offline and one off-site, make backups automatic and test restores regularly. See our cloud backup and disaster recovery services.
• Use multi-factor authentication everywhere, especially on email, remote access and administrator accounts.
• Patch quickly. Apply security updates, especially on anything exposed to the internet. Our article on the PHP2Shell vulnerability is a current example.
• Protect every device with managed antivirus and EDR.
• Limit access. Give people only the access they need (least privilege), and separate important systems from the rest of your network.
• Train your team to spot phishing. One person who does not click can stop an attack.
• Get certified. The Cyber Essentials scheme covers the basic controls insurers and customers look for. See our Cyber Essentials service.

Write an incident response plan before you need one

A good plan turns panic into action. Include:

• key contacts, including your IT provider, insurer, legal adviser and a forensics partner
• what to isolate first
• what logs and evidence to keep
• how to restore from backup, and in what order
• who to notify and when, including the ICO
• who speaks to staff, customers and the press

Practise it once a year with a simple tabletop exercise so the first time you use it is not during a real attack.

How PurpleBox can help

PurpleBox helps UK businesses prevent, respond to and recover from ransomware, from backup and endpoint protection to emergency response. If you are under attack now, call us on 020 7613 1378.

Emergency IT support · Email and network security · Request a callback

Frequently asked questions

This guide is general information, not legal or insurance advice. For decisions about your own business, take advice from a qualified professional and follow guidance from the National Cyber Security Centre and the ICO.