What to do in the first hour of a ransomware attack

In the first hour of a ransomware attack: disconnect affected computers from the network but leave them switched on, don't contact the attackers or pay anything, call an incident response team, tell your cyber insurer, and start writing down what you've seen. Just as important is what not to do: don't wipe, rebuild or restore anything until you know how the attackers got in.

If it's happening right now, call us, or Sophos's UK incident response line on +44 1235 635329. You don't need to be a customer.

The first hour, step by step

1. Disconnect, don't switch off. Unplug the network cable from each affected computer, or turn off its Wi-Fi. Leave it powered on if you can: some of the evidence that shows how the attackers got in is lost when a computer shuts down. If the attack is spreading fast, disconnect your office from the internet as well.
2. Protect your backups. If a backup drive or backup server is still connected to the network, disconnect it now. Attackers go looking for backups, because a business that can restore doesn't need to pay.
3. Leave the ransom note alone. Take a photo of it on your phone, but don't reply to it, visit any website it mentions, or contact the attackers in any other way.
4. Call for help. An experienced incident response team will contain the attack and preserve the evidence. The NCSC recommends that UK organisations use an NCSC-assured incident response provider. Sophos's team, which we work with, holds that status.
5. Tell your cyber insurer. Many policies require you to report an incident promptly, and some name the responders you must use. Calling them early protects your claim.
6. Talk on a separate channel. Assume the attackers can read your company email. Use phone calls, or a messaging group on personal phones, to coordinate until the responders say otherwise.
7. Start a written timeline. When did someone first notice a problem? Which computers and systems are affected? Did anything unusual happen in the days before, such as strange sign-ins, a suspicious email or a slow network? Notes made now save hours later.

What not to do

Most of the damage in the first hour comes from well-meant panic. Avoid these:

• Don't wipe or rebuild computers yet. It destroys the evidence of how the attackers got in, and without that, you can't be sure they're gone.
• Don't restore from backup straight away. If the way in is still open, the attackers can encrypt your freshly restored systems again. Restore once the responders have found and closed it.
• Don't negotiate or pay. More on this below.
• Don't announce it publicly before taking advice. You will need to tell people, but what you say affects your insurance, your legal position and your customers' trust.

Should you pay the ransom?

We never recommend paying a ransom, and neither does the government. The NCSC and UK law enforcement do not encourage, endorse nor condone the payment of ransom demands. The reasons are practical as well as principled:

• There's no guarantee it works. The decryption tool may be slow, broken or never arrive.
• Your data may be published anyway. Most ransomware groups now steal data before they encrypt it, and nothing makes them keep a promise to delete it.
• It marks you as a business that pays, which makes you a more attractive target next time.
• It can be illegal. Paying a group that is under UK sanctions can break the law.

The better route is recovering without the attackers' help. In Sophos's State of Ransomware 2026 survey, two-thirds (66%) of organisations whose data was encrypted recovered it from backups. That's why protecting your backups is step two above, and why backups kept offline, out of the attackers' reach, are worth so much.

Who to tell, and when

Once the first hour is over and help is on the way, work through this list with your responders:

• The ICO, within 72 hours, if personal data may have been stolen or made unavailable, unless it's unlikely to put anyone at risk. The 72 hours start when you become aware of the breach, not when you finish investigating.
• The police and the NCSC, at gov.uk/report-cyber. Reporting helps track the groups responsible, and sometimes leads to decryption keys.
• Your bank, if payment systems or banking credentials may be involved.
• Your customers and suppliers, once you know what was affected and have agreed what to say.

Our guide, Do we need to report a cyber attack?, explains the rules and what to write down.

How it started, and how to stop it happening again

Ransomware is the end of an attack, not the beginning. In the same Sophos survey of 2,158 IT leaders whose organisations had been hit, 79% of attacks started with an identity-based approach: a stolen password, a phishing email or a hijacked account. Small businesses had the hardest time: only 34% of organisations with 100 to 250 employees stopped the attack before encryption or extortion, compared with 46% of the largest.

The difference is usually whether someone spots the early signs. A strange sign-in at 2am or a new admin account appearing overnight is an alert that someone needs to act on, quickly and at any hour. That's what 24/7 managed detection and response is for, and our guide to MDR vs EDR vs XDR explains how to choose.

The other half is being ready. Print this page, keep the emergency number somewhere that doesn't depend on your network, and agree now who makes the calls. Our guide to writing an incident response plan has an outline to start from, and incident readiness can help you write the plan and test it before you need it.

< Back to Guides