Ransomware Attack Response Checklist for Small Businesses

It usually starts with a phone call, not an alarm. Someone can't open a file. Then a folder. Then the shared drive where payroll and invoices live. Ransomware doesn't need to be clever to hurt a twenty-person company. It only needs to be fast, and by the time the note appears on screen, the clock is already running. What you do in the next few hours decides whether this is a bad week or a lost year.

Print this. Trim it to fit your business. Keep a copy somewhere you can still read when the network is down.

The First Hour: Contain, Don't Investigate

The instinct is to click around and see how bad it is. Resist it. Every minute an infected machine stays connected, the attacker can spread sideways, pull more data out, or reach the backups.

• Pull the plug. Disconnect affected machines from the network physically — unplug the Ethernet cable or switch off Wi-Fi. On a machine that's barely responding, that's faster and more reliable than fighting through menus.
• Don't reboot yet. Memory can hold encryption keys, scripts and connection details that a forensic investigator or your insurer's incident response team will want. A reboot wipes them.
• Isolate the whole segment if you're unsure. If you can't tell how far it has spread, disconnect the internet at the router and power down the office switch. It's disruptive. It's also reversible, unlike a second encryption pass.
• Protect the backups. If your backups are reachable from the network, cut them off now. Unplug external drives and check that cloud backup credentials haven't been reused elsewhere.

Write the time down. When the first report came in, who noticed it, what you unplugged and when. You will not remember this accurately tomorrow.

Preserve Evidence and Watch What You Say

Don't delete the ransom note. Photograph the screen with your phone if the machine won't cooperate. Keep logs, even if you can't read them yet. If you have a managed service provider, tell them not to wipe anything until a decision is made about forensics.

Set up a communication channel that runs outside your own network — mobile phones, a personal email account, a messaging group. Many ransomware crews watch internal chat and email after they're in, which is one reason to keep your written comments factual and free of negotiation talk. Let counsel handle any contact with the attackers.

Give People Roles Before Everyone Gets Tired

In a small company, the same three people do everything. That's exactly why roles need to be named in advance, so nobody is guessing at 11pm.

Name these five

1. Incident lead — usually the owner or operations manager. Makes the calls, owns the timeline.
2. Technical lead — your IT person or MSP. Only they touch systems.
3. Insurance and legal contact — one person calls the cyber insurer's hotline and your lawyer.
4. Communications lead — talks to staff, customers and suppliers. One voice, one message.
5. Scribe — keeps the running log of decisions and times.

Everyone else stays off the systems and off social media. Well-meaning colleagues "just checking something" is how clean machines get reinfected.

Notify Stakeholders in the Right Order

Order matters, and it's roughly this:

• Your technical lead or MSP, so containment starts.
• Your cyber insurer, often within a window set by the policy. Read the policy now, not during the incident.
• Legal counsel, who can advise on breach notification duties and protect the investigation under privilege.
• Law enforcement — reporting helps, and your insurer or counsel may expect it.
• Regulators, customers, staff and your bank if personal or financial data was involved. Deadlines differ by jurisdiction, so let counsel confirm which apply to you.

A short note to staff early — "systems are down, here's how we'll communicate" — prevents a hundred anxious phone calls. Customers can wait a few hours for something accurate rather than something fast and wrong. Where legal or regulatory obligations are involved, take professional advice before you send anything.

Restore Without Getting Hit Twice

Rebuild from clean images, not from the encrypted network, and only after the entry point is closed. Restore a test server on isolated hardware first, confirm the backup itself isn't compromised, and then bring systems back in stages — email, then finance, then everything else. A staged return is slower and far less painful than a second encryption event.

Before anything comes back online, rotate every credential: user passwords, service accounts, API keys, VPN logins, and session tokens. Reset multi-factor authentication enrolments. If you don't know how they got in — a phishing email, an exposed remote desktop, a VPN without MFA, a supplier's account — assume the door is still open.

And assume data was stolen, even if you get it all back. Many attacks copy files before encrypting them, which matters for what you tell customers and regulators.

The Payment Question

Paying funds criminal groups, doesn't guarantee a working decryption tool, and can be slow: negotiating, proving you have cryptocurrency, waiting for a key that sometimes fails on large files. There can also be legal complications depending on who you'd be paying. Involve your insurer and legal counsel in that conversation, and be honest with them about the pressure you're under.

Most businesses that recover well do it from backups, not from a key. Every hour spent on payment talks is an hour not spent rebuilding.

Rehearse the First Hour Before You Need It

The plan is only as good as the practice. Once a year, gather the five people above, turn off the internet for an hour and walk through a scenario: "The file server is encrypted and the note is on every desktop. Go." Forty-five minutes of that will expose more gaps than any policy document.

Then do the boring things that make the checklist work: keep three copies of your data on two kinds of media with one offline, test a restore, turn on MFA everywhere it's offered, and patch the things that face the internet. Print the plan, list phone numbers on paper, and put a copy in the car and at home. When the network is gone, so is your contact list.

The businesses that come through a ransomware attack with a bad week instead of a lost year are rarely the ones with the biggest budgets. They're the ones who wrote down what to do, knew who would do it, and had practiced it once.

Photo: Ivan Chumak / Pexels