CISA’s #StopRansomware Guide warns that “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups to make restoration impossible unless the ransom is paid.” Recovery starts with a locked copy.
CISA, #StopRansomware Guide
First hour: stop the spread
Contain first. This is an operating checklist, not legal advice.
Disconnect, do not wipe
Unplug the network cable or turn off Wi-Fi on affected machines. Do not wipe or reinstall anything yet.
Protect the backups
Unplug any backup drive or NAS still attached, and pause file sync so encrypted files stop spreading.
Start a written log
Note the time, what you saw, who found it and every action taken. Photograph the ransom note.
Contact your insurer
If you have cyber insurance, contact the insurer before hiring anyone. Your policy may name the response firm to use.
Tell your backup provider
If Ezbre runs your backups, email support@ezbre.com with “URGENT” in the subject, from an account you trust.
First day: report and assess
Get the right people in, then find a clean copy.
Bring in counsel
Your counsel and insurer advise on notices to clients or regulators, and on any contact with the attackers.
Report the attack
Report it to the FBI through its Internet Crime Complaint Center at ic3.gov. Ask counsel what else to report.
Map the damage
List every affected machine, account and shared folder, and when each was last known to be working normally.
Find the clean copy
Identify the last backup taken before the attack began, and confirm that its locked copies are intact.
Reset key passwords
From a clean device, reset admin, email and backup passwords, and turn on two-factor sign-in wherever it is missing.
Agree the restore order
Decide which systems come back first, usually the ones that payroll, billing and customers depend on.
First week: restore in order
Bring systems back one at a time, and check each one.
Close the way in
With your response firm, find and fix how the attackers got in before restoring onto the network.
Rebuild, then restore
Rebuild affected machines from clean images or fresh installs before restoring data onto them.
Restore in priority order
Bring back the agreed first system, check it works, then move to the next.
Scan before use
Scan restored files before staff open them, in case the attackers were inside before the encryption started.
Keep people informed
Update staff, clients and partners on a set schedule, using wording your counsel has approved.
Write it down
Record the timeline, the cost and what you would change, while it is fresh. It becomes your runbook’s next draft.
Before it happens
Five things that make every step above shorter.
A locked copy
Keep one locked or offline copy in another region, out of reach of admin passwords. See Immutable Offsite Copy.
A tested restore
Restore and time a full system on a schedule, so you know your real recovery time. See Restore Drill.
A printed runbook
Turn this page into restore steps with your own names and systems, and print it. See Recovery Runbook.
Separate backup sign-in
Give the backup system its own accounts with two-factor sign-in, not your everyday admin account.
Contacts off the network
Keep your insurer’s claims contact, policy number, counsel and IT provider on paper, away from the network.
Ransomware recovery questions, answered
Should we pay the ransom?
That is not a decision we can make for you, and it should not be made alone. Talk to your cyber insurer, your counsel and law enforcement first. What we can tell you is whether a clean, locked copy exists and how long a restore is likely to take, which is part of what that decision rests on.
Who should we contact first?
Your cyber insurer, if you have a policy, then your counsel. Your policy may require a response firm it has approved, so contact the insurer before hiring anyone. Report the attack to the FBI at ic3.gov, and tell whoever runs your backups so they can protect the copies.
Can we restore straight from backup?
Only after the way in is closed and the machines are rebuilt or confirmed clean. Restoring onto an infected machine can bring the problem straight back. Choose a copy taken before the attack began, which may be older than last night’s, and restore the most important system first.
Is this checklist legal advice?
No. It is an operating checklist from a backup company, written to keep the first week calm and in order. Notices to clients or regulators, contract duties and any contact with the attackers are questions for your counsel and your cyber insurer. Follow their advice where it differs from this page.
Check your locked copy today
When things are calm, a free 45-minute backup check shows which copies an attacker could reach and runs one test restore.