Ransomware attack: What NOT to do in the first few minutes — mistakes that make everything worse

Absolutely do not delete or overwrite virtual server snapshots. If possible, avoid moving any files around in the OS until an expert arrives who can take a live memory dump. Altering file attributes makes it much harder to pinpoint the exact strain of the malware.

The only thing to do right this second: physically unplug the ethernet cables from the back of every single PC, infected or not, and pull the plug on the office router and Wi-Fi access points. Kill all network traffic entirely but leave the machines powered on.

Last year, one of our clients panicked during a similar incident and rebooted their server, wiping the encryption key from RAM. The data recovery lab reported there was roughly a 70% chance they could have pulled the key straight from memory if the box had just been left running.

biggest mistake is plugging a backup drive u think is clean into the server to check it if malware is still running in the background it'll encrypt your bacukp in seconds and leave u with nothing.

Under the European Union General Data Protection Regulation, if there is a risk to personal data, it is a legal requirement to notify the competent data protection authority within 72 hours of becoming aware of the breach. Make sure to preserve communication logs and system event records meticulously.

Don't listen to staff suggesting paying the ransom. Even if you pay up there's zero guarantee they'll give you a working key or that your systems will recover properly. Plus, you end up marked as an easy mark for future attacks.

Three things you must never do in the first half hour: 1) Do not reboot or pull the power on servers, 2) Do not attach clean backup storage to the network or any machine, 3) Do not open any dialogue with the attackers via the email or links in the ransom note.

Really sorry to hear this it's an incredibly stressful situation but there is still hope if you keep your cool. Once your IT specialist gets there, let them inspect the machines only while completely disconnected from the network. Staying calm is rule number one for data recovery.

Saved. Trying to do this alone is the most expensive way.

Security isn't absolute; it's about making attacks not worth the effort. If you have questions, write them; I'll answer as best I can.

i didnt know that.

My perspective changed after experiencing that. Most time waste accumulates in tasks waiting for approval.

Of course, it varies if your situation is different.

Three different views emerged, they all complement each other. Having backups accessible on the same network and with the same identity makes them part of the target.

I'm also curious if anyone does it differently.

Looking at it as a process, the picture changes. Don't rely on a single measure; go layer by layer.

Just leaving this note, it might be useful.

Timely topic. If it's your first time, start small; scaling comes later.

Just leaving this note, it might be useful.

there different views emerged they all complement each other. when we decide without measuring we always end up in the same place.

This thread is archived.

let me share what happened to me; it might be useful. btw forgotten test environments are more often the entry point than live systems.

just leaving this note, it might be useful.

quick summary for newcomers: Trying to do this alone is the most expensive way.

if it's your first time start small; scaling comes later. good luck with that.