iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Disconnect first, do not shut systems down unless you cannot isolate them, and report the incident promptly. Paying a ransom is not a reliable recovery plan: the FBI, CISA, NSA, FTC and the UK National Cyber Security Centre (NCSC) all warn that payment may not restore data, stop publication of stolen information or prevent another attack. Preserve evidence, use out-of-band communications, investigate how the intrusion spread, and restore only from backups that responders have verified as clean.
The exact notification duties depend on your country, industry, contracts and the data involved. In the United States, contact a local FBI field office and file with the Internet Crime Complaint Center (IC3), contact CISA where appropriate, and involve counsel and any required regulators. UK organizations should follow NCSC reporting routes. Report even if payment is being considered or has already been made.
What to do in the first minutes
Ransomware response is a containment problem before it is a recovery or negotiation problem. Every minute that an infected host can reach another system gives the intruder more opportunity to encrypt files, steal credentials or exfiltrate data.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Identify the apparent scope. Note which computers, servers, cloud workloads, network segments and mobile devices show ransom notes, unusual encryption, disabled security tools or suspicious account activity. Do not wait for a perfect inventory before isolating an obviously affected host.
- Isolate affected systems immediately. Unplug Ethernet, disable Wi-Fi and remove other wired, wireless or mobile network paths. If several machines or a subnet are involved, take that network offline at the switch level when feasible. Isolation should include remote-access paths and shared storage that may still be reachable.
- Protect communications. Assume the attacker may monitor email, chat or compromised collaboration accounts. Use out-of-band phone calls or another trusted channel to coordinate the response and avoid broadcasting containment plans through the compromised environment.
- Preserve evidence while containing the spread. Save ransom notes, payment instructions, attacker messages, timestamps, system images, logs and, when qualified responders direct it, memory captures. Record who isolated each device, when, and what connection was removed.
- Escalate to the response team. Notify leadership, legal counsel, the cyber insurer, the managed security provider and an experienced incident-response firm according to your plan. Keep a single incident log so technical, legal and business decisions can be reconstructed.
Do not reconnect a device merely to see whether it is still infected. Reconnection can give the intruder a route back into systems that have not yet been examined.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Disconnect or turn the computer off?
Disconnect first. CISA advises immediate isolation and says to power down only when you cannot disconnect the device from the network. The FTC gives the same evidence-preserving principle. A shutdown can erase volatile-memory evidence that may show the malware, encryption keys, active sessions or the attacker’s tools.
| Action | Containment speed | Volatile-evidence impact | When it fits | Main downside |
|---|---|---|---|---|
| Unplug Ethernet or disable Wi-Fi | Immediate for that host | Preserves live memory | Default action for an affected workstation, server or appliance | The host may still affect locally attached devices or removable media |
| Isolate a switch port or subnet | Immediate for many hosts | Preserves evidence on powered systems | Multiple systems or a shared segment are affected | Can interrupt legitimate services and may miss an alternate network path |
| Power down | Stops execution, but only after shutdown completes | May destroy volatile evidence | Only when network disconnection is impossible or responders specifically direct it | Forensic loss and possible complications during later analysis |
| Continue operating normally | No containment | Evidence may change while the attack spreads | Not an appropriate response to a suspected active infection | Allows additional encryption, lateral movement or theft |
If a device cannot be disconnected safely, document the limitation and ask responders for direction before powering it down. When a shutdown is unavoidable, record the reason, time and person who authorized it.
Should you pay the ransom?
Official guidance does not treat payment as dependable recovery. The FBI states, “The FBI does not support paying a ransom in response to a ransomware attack.” The bureau also warns that payment does not guarantee data recovery and can encourage the perpetrators and additional criminal actors. CISA, the FBI and NSA similarly warn that payment can embolden adversaries, fund illicit activity and make further attacks more attractive. The FTC says law enforcement does not recommend paying, while recognizing that the final business decision involves risks and costs.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →What payment cannot guarantee
- A working decryptor or complete recovery of files.
- Removal of the attacker’s persistence or stolen credentials.
- Deletion or non-publication of data that was copied before encryption.
- Protection from a second demand, a repeat intrusion or resale of the stolen data.
- That the recipient is not sanctioned or otherwise unlawful to transact with under the applicable jurisdiction.
NCSC guidance is equally clear for the United Kingdom: “The NCSC and UK law enforcement do not encourage, endorse or condone the payment of ransom demands.” A payment discussion should therefore be treated as a high-risk legal, operational and ethical decision, not as a standard recovery step.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
If leadership is considering payment
Do not negotiate or transfer funds from a compromised account without legal and specialist advice. Involve counsel, law enforcement, the insurer and qualified incident responders first. Preserve the original demand and all communications. Determine what data was stolen, whether clean backups exist, what services are essential, and whether sanctions, anti-money-laundering rules, contractual duties or sector regulations apply. Report the incident even if a payment is ultimately made.
Who to call and what to report
Reporting helps authorities link campaigns, warn other victims and investigate the criminals. It is appropriate whether or not payment is being considered and whether or not the ransom has already been paid.
United States
- Contact your local FBI field office and file a report with the Internet Crime Complaint Center (IC3).
- Contact CISA when its assistance or coordination is appropriate for your organization or sector.
- Follow notification requirements for state or federal regulators, contractual partners and sector authorities.
- Ask counsel to assess breach-notification, privacy, employment, sanctions and records-preservation duties.
United Kingdom
Follow NCSC reporting routes and obtain legal advice on data-protection, sector and contractual obligations. The correct route can differ for a public body, regulated provider and private company.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Other jurisdictions
There is no universal deadline or single regulator. Duties vary by geography, industry, the type of information accessed and whether critical services were disrupted. Your counsel or regulator can identify the applicable rule; do not assume that paying, restoring from backup or keeping the incident confidential removes a reporting obligation.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Prepare the reporting package
- The ransom note, file extension and payment or cryptocurrency-wallet details.
- Attacker emails, chat messages, negotiation records and caller information.
- Timeline with discovery, isolation, shutdown and restoration events, including time zone.
- List of affected hosts, accounts, cloud services, subnets and business processes.
- Indicators of compromise such as suspicious domains, hashes, filenames, IP addresses and persistence mechanisms.
- Relevant firewall, identity, endpoint, backup and cloud logs, plus system images or memory captures obtained by qualified personnel.
- Evidence or a reasoned assessment of data exfiltration, including what records may be involved.
- Any payment transaction, broker or wallet information if funds were transferred.
Investigate before you eradicate
Containment stops immediate spread; it does not prove that the intruder is gone. Experienced internal or third-party responders should establish the initial access vector, map lateral movement, identify persistence and determine which data was viewed or copied.
Questions the investigation must answer
- Which account, vulnerability, exposed service or supplier connection provided initial access?
- When did the attacker first enter, and how long were credentials or tools present?
- Which endpoints, servers, identity systems, backups and cloud resources were touched?
- Were administrator credentials, tokens, encryption keys or recovery accounts compromised?
- What evidence shows exfiltration, and what data categories are affected?
- Are there scheduled tasks, new accounts, remote tools or other persistence mechanisms that will survive a reboot?
Eradication should remove malware and persistence, close the entry point, revoke sessions and tokens, and rotate credentials after systems are known to be clean. Changing passwords while an attacker still controls a privileged host can simply hand over the new credentials.
Can you restore from backup safely?
Yes, but only after validating both the backup and the environment receiving it. A backup connected to the network during the attack may have been encrypted, deleted or altered. Treat every copy as untrusted until responders confirm its origin, integrity and separation from the compromise.
- Inventory recovery copies. Locate offline, immutable or otherwise isolated copies, recovery images, configuration exports and the software or licenses needed to use them.
- Check the backup timeline. Prefer a version created before the attacker’s first access, not merely before the ransom note appeared. Investigators may revise that date as they examine logs.
- Verify integrity and malware status. Scan copies with trusted tools, compare hashes where available, and inspect restored systems in a segregated recovery network.
- Rebuild foundational services first. Establish clean identity, network, DNS, security monitoring and management systems before reconnecting application servers or user devices.
- Restore by business priority. Bring back the minimum services needed for safety and essential operations, then observe them for suspicious activity.
- Reconnect in a controlled sequence. Keep clean systems segmented, enforce least privilege, monitor authentication and network traffic, and stop if indicators of compromise reappear.
Do not restore an entire environment in one uncontrolled step. A single compromised administrator account or unexamined backup agent can reintroduce the attacker.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Recovery decisions and operational trade-offs
Teams often face pressure to resume operations immediately. Use these criteria to make the trade-off explicit:
| Decision factor | Isolation and investigation | Immediate payment or rapid reconnect |
|---|---|---|
| Containment speed | Stops reachable spread when applied decisively | Does not remove access; reconnecting can spread the intrusion |
| Volatile evidence | Preserved when systems remain powered but disconnected | May be lost through hurried shutdowns or reboots |
| Known-clean recovery | Allows backup validation and staged rebuilding | Can restore compromised files, accounts or persistence |
| Legal and regulatory exposure | Creates time to assess reporting and sanctions duties | Payment may create additional legal review and reporting issues |
| Repeat extortion risk | Addresses the entry point and stolen credentials | Does not ensure deletion of stolen data or prevent another attack |
| Operational downtime | Often longer initially, but produces a controlled return | May appear faster but has no guaranteed recovery outcome |
Communications with employees, customers and partners
Keep public and internal statements factual and coordinated with counsel. State what is known, what services are unavailable, what users should do and where verified updates will appear. Do not publish ransom notes, investigative theories or personal data that could help the attacker. Tell staff not to connect personal devices, copy encrypted files to shared drives or contact the attacker independently.
Use an out-of-band channel for the incident team, and verify requests for emergency payments or credential changes through a second trusted method. Attackers may impersonate executives after reading compromised mailboxes.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow to prepare before the next incident
- Maintain offline, encrypted backups with access controls that ransomware cannot reach through ordinary administrator credentials.
- Test restoration regularly, including a full-service recovery rather than only checking that a backup job completed.
- Keep recovery images, configuration files and required installation software available and documented.
- Segment critical systems and restrict administrative access so one compromised account cannot reach every subnet and backup.
- Exercise an incident-response and communications plan with technical, legal, executive, insurer and public-relations participants.
- Document who can authorize network isolation, shutdown, regulator notification and restoration.
- Include an external hard drive for offline backups only as one component of the strategy. Disconnect it or protect it from ordinary network credentials, rotate copies, encrypt the data and test that the drive can actually restore required services.
After recovery, conduct a lessons-learned review. Update detection rules, patch the exploited entry point, revise contact lists and rehearse the revised procedures so the next decision is made from a plan rather than under pressure.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
