Ransomware: what to do in the first ten minutes
Updated 10 November 2026 · Security
Files that will not open, strange file names or a ransom note on screen. The steps that limit the damage, and the ones to avoid.
Ransomware is malicious software that scrambles your files and demands payment to unlock them. It is the most damaging thing that can happen to a small business's computers, and what you do in the first few minutes makes a real difference. Keep this page somewhere you can find it.
How to recognize it
Files suddenly will not open or show an error saying they are damaged. File names have changed or have an unfamiliar ending added to them. A note appears on the screen or in every folder explaining that your files are encrypted and how to pay. The computer becomes very slow while the disk light is constantly busy.
Do this straight away
Disconnect the computer from the network. Unplug the network cable if there is one, and turn off Wi-Fi from the icon near the clock or switch the computer to airplane mode. This stops it spreading to shared drives and other computers. Do not turn the computer off, because information in memory can help us understand what happened. Simply leave it disconnected. Then call us on 855-248-2637 and say the word ransomware. We treat it as an emergency, around the clock for clients on a managed plan.
Do not do this
Do not pay, reply to or contact the attackers. Do not try to delete the ransom note, restore files or run cleaning tools, because that can destroy evidence and make recovery harder. Do not plug in USB drives or backup disks to "save" files, as they can be encrypted too. Do not use the affected computer to email anyone about it.
What we do
We isolate the affected devices, stop the spread, find out how it got in, and secure the accounts involved. We then restore your data from backups that the ransomware could not reach and confirm the systems are clean before reconnecting them. If personal information may have been exposed, we help you understand your obligations to report it under the privacy laws that apply to your business. If you have cyber insurance, call your insurer as soon as you can, as most policies require early notice.
Preventing it
Most ransomware arrives through a phishing email, a stolen password or an unpatched system. Multi-factor authentication, up-to-date computers, Microsoft Defender kept switched on, careful clicking and backups we test regularly are the protections that matter. Our Security basics articles cover each of them.
Was this helpful?
Related