iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
If ransomware has encrypted your organization’s data, activate your incident response plan, contain affected systems without destroying evidence, and bring in qualified responders. Coordinate leadership, IT and security, legal, privacy, communications, insurers, and relevant service providers through the channels your plan specifies. Do not rush to wipe systems, restore backups, or pay before the incident is understood.
What should you do first?
Use the organization’s approved incident response and communications plans. Assign an incident coordinator if your plan calls for one, and keep leadership updated. If internal systems may be monitored by the attacker, use out-of-band communications such as phone calls for sensitive coordination. CISA’s official #StopRansomware Guide, developed with MS-ISAC, NSA, and the FBI, recommends coordinated response and communications.
- Activate the response plan. Notify the people responsible for leadership, IT and security, legal, privacy, communications, insurance, and affected service providers as directed by the plan.
- Contain affected systems. Identify impacted devices and isolate them from networks as promptly as practical. If multiple systems or subnets appear affected, CISA says taking the network offline at the switch level may be necessary.
- Establish scope. Determine which systems, accounts, services, and data are affected. Review endpoint protection, monitoring tools, and logs for signs of earlier or wider compromise. Identify dependencies and prioritize systems needed for health and safety, critical services, and revenue.
- Coordinate response and recovery. Keep a record of decisions, observed symptoms, affected assets, and actions taken. Avoid uncoordinated cleanup that could remove evidence or leave an attacker’s access in place.
CISA’s resource page gives the guide’s revision date as October 19, 2023. The guide is general incident-response guidance; it does not determine the right technical or legal choice for every organization or incident.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchShould you shut down infected computers?
Usually, isolate an affected computer from networks rather than immediately powering it off. CISA cautions that powering down can destroy volatile-memory evidence; it recommends doing so only when the device cannot otherwise be disconnected. The decision depends on the risk of ongoing spread, the value of evidence that may be lost, and the safety or business impact of keeping the device running.
#1 Best Overall
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
| Action | When it may fit | Key trade-off |
|---|---|---|
| Disconnect from the network | When the device can be isolated promptly without powering it off | Can limit network access while preserving volatile-memory evidence, though it may not stop activity on the device itself. |
| Power off | When the device cannot otherwise be disconnected and leaving it on presents an unacceptable risk | May stop some activity but can destroy volatile-memory evidence. |
| Take a network offline at the switch level | When multiple systems or subnets appear affected and individual isolation is insufficient | May contain spread, but can disrupt services; weigh the operational impact against the ongoing threat. |
Make containment decisions with incident responders where possible. If the situation is moving quickly, follow the response plan and document what was disconnected or powered off and when.
How can you tell whether data was stolen?
Do not assume encryption is the only harm. Ransomware incidents may also involve data exfiltration and threats to publish stolen information, sometimes called double extortion. Data extortion can also occur without encryption.
Use available logs, endpoint and network monitoring, and other evidence to assess whether sensitive or personal information may have been accessed or taken. Establish what systems and accounts were affected and what data they held. Treat the assessment as uncertain until evidence supports a conclusion; an encrypted file alone does not establish whether data was copied. Engage legal and privacy teams to assess the implications of confirmed or suspected access.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
How should you preserve evidence and get help?
Preserve relevant evidence where feasible, including logs, system images, memory captures, malware samples, and indicators of compromise. Have qualified responders guide collection and analysis so that investigation does not unnecessarily disrupt containment or recovery. CISA notes that federal contacts may assist with technical response and evidence-related analysis.
- Report the incident and consider assistance from CISA, the local FBI field office, or the FBI’s Internet Crime Complaint Center (IC3); the CISA guide also lists other federal contacts.
- Coordinate with your cyber insurer and any managed or security service providers under existing agreements.
- Record key decisions and preserve available incident records. Avoid wiping or rebuilding affected systems before responders have assessed whether doing so could destroy useful evidence or leave access unaddressed.
Should you pay the ransom?
Do not treat payment as a guarantee that data will be restored, stolen information will remain private, or the attacker will lose access. The CISA guide advises consulting federal law enforcement about possible decryptors: security researchers sometimes identify flaws and release tools for particular ransomware variants, but that possibility is variant-specific and is not a universal recovery method.
Escalate any payment decision through organizational leadership, counsel, the insurer, and appropriate law-enforcement contacts. The general CISA guidance does not settle the legal or operational choice for an individual victim; the decision requires case-specific advice and a clear understanding of the risks.
Rank #3
- No wall warts: Work freely with its bus-powered USB-C. No wall outlet required.
- Big on space: High-capacity storage to store all your files in one place.
- Reliable backup: Safeguard assignments, projects, or sensitive files with trusted performance.
- Fuss-free, clutter-free: One port, one cord, quick connect.
- Peace-of-mind: Comes with two-year limited warranty and Rescue Data Recovery Services.
How do you restore from backups safely?
Recover in a clean environment after the compromise has been contained and eradicated. Confirm that systems entering the recovery environment are clean, then restore services in priority order using validated backups. Include the dependencies required for essential services, rather than restoring systems in isolation.
Recommended Free Tools
CISA advises organizations to “Maintain offline, encrypted backups of critical data, and regularly test the availability and integrity of backups in a disaster recovery scenario.” Backups that remain accessible to compromised systems may be found and deleted or encrypted by ransomware, so verify the backup’s integrity and whether it was exposed before relying on it.
An external hard drive for offline backups can be one component of a backup strategy, but the right medium and architecture depend on the organization’s needs. A backup drive does not decrypt data already encrypted, prove that a backup is uncompromised, or replace incident response. Test restoration procedures regularly so recovery does not depend on discovering whether a backup works during an emergency.
Rank #4
- High-capacity external hard drive with up to 2TB of storage The ModusTech Facet portable external hard drive gives you dependable HDD storage in a slim 2.5-inch design. Multiple capacities available up to 2TB — back up photos, videos, music, documents, and game libraries with room to grow. A trusted external storage solution for everyday backup, media archives, and creative work.
- USB-C and USB 3.1 connectivity with included 2-in-1 cable The Facet ships with a USB-C to USB-C cable and tethered USB-A adapter, so this external hard drive connects to modern laptops, USB-C iPhones, tablets, and older USB-A computers without buying an extra cable. USB 3.1 Gen 1 (5Gbps) interface delivers real-world transfer speeds up to 100MB/s — fast enough to back up 50GB of files in about 8 minutes.
- Plug-and-play external hard drive for PC, Mac, and laptops Preformatted in exFAT and ready to use the moment you plug it in. The Facet works out of the box with Windows PCs, macOS Macs, MacBooks, Chromebooks, and laptops — no drivers, no software, no setup required. A true plug-and-play external hard drive built for everyday use across every major operating system.
- External hard drive for PS4, Xbox One, and Smart TV gaming The Facet is compatible with PlayStation 4, Xbox One, and Smart TVs with USB support. PS4 and Xbox One games run directly from the drive — plug it in, format through the console, and add to your storage. Also works with Smart TVs that support USB recording or external media playback.
- Slim, shock-resistant portable external hard drive — 160g At 2.5 inches and just 160g, this portable external hard drive is bus-powered through a single USB-C cable — no separate power adapter, no extra cables. Slim enough for a laptop bag, jacket pocket, or camera bag, with a shockresistant casing and faceted diamond-texture top panel that resists fingerprints and everyday wear. Backed by a 1-year limited warranty from ModusTech, a consumer electronics brand specializing in external storage.
Who may need to be notified?
Follow the incident plan and obtain legal review before deciding whether and when to notify affected individuals, regulators, customers, or business partners. The answer depends on jurisdiction, industry, the information involved, contractual terms, and confirmed facts. There is no single notification deadline established by the general guidance described here; do not assume one applies everywhere.
What to do after recovery
After restoring essential operations, document lessons learned and update incident response, communications, and disaster recovery plans. Use the incident to identify gaps in containment, evidence preservation, backup protection, and restoration testing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
