Skip to main content
DME Computer Services
👉 Check real-time service outages here
Omaha office · 9224 S 169th St
Serving local businesses since 2016
Veteran-owned and operated
Onsite support across the metro
Free Recovery Resources

Hit by Ransomware? Here's Exactly What to Do.

Quick, actionable guides written for business owners — not security engineers. Follow them in order: stop the spread, contain the damage, report it correctly, and recover without reinfecting yourself.

First 60 MinutesHours 1–24Day 1–3Recovery
Under attack right now? Call DME for emergency response: 402-650-8407FBI IC3: ic3.gov · CISA: cisa.gov/report
First 60 Minutes

The First Hour: Stop the Spread

What you do in the first hour matters more than anything else. Move fast, but don't destroy evidence.

  1. 1.Disconnect infected machines from the network — unplug Ethernet cables and turn off Wi-Fi. Do NOT power computers off; encryption keys may still be in memory.
  2. 2.Disconnect shared drives, NAS devices, and external backups immediately — ransomware targets backups first.
  3. 3.Disable remote access: VPN, RDP, and remote support tools until you know how the attacker got in.
  4. 4.Take photos of ransom notes and any on-screen messages with your phone — you'll need them for the FBI, insurance, and investigators.
  5. 5.Write down a timeline: when it was noticed, which machines, what looked wrong. Memory fades fast under stress.
  6. 6.Call your IT provider or an incident response team before touching anything else.
Hours 1–24

Contain and Assess the Damage

Once the bleeding is stopped, figure out what you're actually dealing with before you rebuild anything.

  1. 1.Identify the ransomware strain — the ransom note filename and extension of encrypted files usually identify the group. Free decryptors exist for some strains at nomoreransom.org.
  2. 2.Change every privileged password from a clean, uninfected device — domain admin, Microsoft 365 global admin, firewall, banking.
  3. 3.Force sign-out of all Microsoft 365 / Google Workspace sessions and enable MFA if it wasn't already on.
  4. 4.Check whether data was stolen, not just encrypted — most modern groups exfiltrate first and threaten to publish it (double extortion).
  5. 5.Verify your backups: are they intact, offline, and from before the infection date? Do NOT restore yet — the attacker's entry point may still be open.
  6. 6.Quarantine — don't wipe — infected machines. Forensic evidence on them determines how the attacker got in and whether data left your network.
Day 1–3

Report It: Insurance, FBI, and Nebraska Law

Reporting isn't optional. Your insurance policy, federal agencies, and Nebraska statute all have clocks running.

  1. 1.Notify your cyber insurance carrier immediately — most policies require notice within 24–72 hours and will assign a breach coach and approved incident response firm. Acting without them can void coverage.
  2. 2.File a report with the FBI at ic3.gov, or call the Omaha FBI field office at (402) 493-8688.
  3. 3.Report to CISA at cisa.gov/report — they provide free guidance and track active campaigns.
  4. 4.Nebraska businesses: if resident data was exposed, Neb. Rev. Stat. §87-801 (the Financial Data Protection Act) requires notifying affected Nebraska residents and the Nebraska Attorney General.
  5. 5.Healthcare organizations: HIPAA requires notifying HHS OCR within 60 days if 500+ individuals are affected — plus media notice.
  6. 6.Loop in legal counsel before sending any breach notifications — wording and timing carry legal consequences.
Recovery

Recover Safely — Don't Reinfect Yourself

The #1 recovery mistake is restoring systems while the attacker's backdoor is still open. Close the door first.

  1. 1.Find and close the entry point before restoring — typically a phished account, exposed RDP, unpatched VPN appliance, or stolen credentials.
  2. 2.Rebuild infected machines from scratch (fresh OS install). Cleaning an infected machine is never fully trustworthy.
  3. 3.Restore from the most recent clean backup — scan restored data with EDR before reconnecting it to the network.
  4. 4.Reset ALL credentials organization-wide after restoring, and rotate service account and API keys.
  5. 5.Deploy monitoring (EDR/MDR) before going back online — repeat attacks within 90 days are common because attackers know you're vulnerable.
  6. 6.Hold a post-incident review: document what happened, what worked, and fix the gaps — patching, MFA, offline backups, and staff training.

6 Things NOT to Do

These mistakes turn a bad week into a catastrophic one. Avoid all of them.

  • Don't pay the ransom before talking to the FBI, your insurer, and counsel — payment doesn't guarantee decryption, and paying sanctioned groups is illegal.
  • Don't power off encrypted machines — you may destroy recoverable encryption keys in memory.
  • Don't wipe or reimage machines before evidence is preserved.
  • Don't communicate about the incident from potentially compromised email accounts — attackers often read your inbox.
  • Don't restore backups onto a network that hasn't been cleaned — you'll lose your clean copy too.
  • Don't announce details publicly before legal review — statements can create liability.
See what the ransom note actually says — and why it lies

Don't wait for the attack to find your gaps

Most ransomware victims had exposed remote access, missing MFA, or online-only backups. Check your exposure for free, or talk to us about ransomware-ready protection.

Run a free exposure scan Ransomware protection services