Ransomware encrypted all our company servers last night, what exactly should I do in the first few hours?

Right this second pull the ethernet cables from every PC in the office and disable Wi-Fi. Do not pull power cords or shut down infected machines; just isolate them from the network. Powering off completely can wipe transient encryption keys from RAM and destroy digital forensic evidence.

Copy a couple of encrypted file samples and the ransom note onto a clean USB drive and check them on an isolated machine. You need to identify the exact malware strain. With some older variants, the symmetric key might still be sitting in memory, or security researchers may have already released a public decryptor for that build.

People who think paying the ransom will get their files back usually end up sorely disappointed. A logistics company in Madrid in a similar spot paid 30,000 euros; the decryptor they sent corrupted half the files, and two weeks later they broke in through the exact same vulnerability and demanded more money. Do not pay them under any circumstances.

Our storage got locked down by a similar attack last year. We paid an independent third-party incident response specialist 5,500 euros. We had an offline tape backup from two weeks prior, so we restored from that and manually re-entered the invoices issued in between. We lost 4 days of work in total, but we didn't pay the extortionists a single cent.

Any idea how the attackers got in? Was there an exposed remote desktop (RDP) port, or did an employee open an attachment from an email? Don't you have any other backups that are completely isolated from the network or keep historical versions in the cloud?

Please ensure you do not miss the deadline for notifying the Spanish Data Protection Agency (AEPD). Even if the technical investigation is not completed within the 72-hour window, the initial notification must be submitted, with supplementary reports added to the file as the extent of the damage and the number of affected records become clear.

so sorry to hear this I know all too well that helpless feeling of walking into the office in the morning and seeing that screen. tell your team not to panic, keep your clients calm by telling them you're doing technical maintenance and look into getting professional help immediately.

If you've pulled the network cables, don't format anything and bring in a professional cyber incident response consultant right away.

My question might sound amateurish, sorry about that. The real issue isn't the number, but what it's based on.

I've been down this road, let me tell you. Trying to do this alone is the most expensive way.

If I were you, I'd go this route.

Just a heads-up. Forgotten test environments are more often the entry point than live systems.

Good luck with that.

You're right.

There's a common mistake people make when doing this. An automated scan report is not the same as a penetration test.

I'm also curious if anyone does it differently.

My perspective changed after experiencing that. The answer varies greatly by industry; there is no one-size-fits-all rule.

Payment information changes are never verified through the channel they came from. Just leaving this note, it might be useful.

We got stuck at the same point for a while. Hasty decisions become decisions you have to fix six months later.

Hope this helps.

I'd appreciate it if you shared the outcome. Don't hesitate to ask; those who don't ask always pay more.

I'm also curious if anyone does it differently.

I'm curious too.

Let me summarize the topic, since several different answers were given. When we decide without measuring, we always end up in the same place.

Proven by experience.