We have ransomware. What do we do right now?

Immediate actions, in this order:

• Disconnect affected machines from the network. Unplug the cable or turn off Wi-Fi. This stops it spreading to everything else, which is the thing that turns a bad day into a catastrophe.
• Leave them powered on. Turning them off can destroy information useful for identifying the variant and sometimes for recovery.
• Call us. 904-204-6870. Then call your cyber insurance carrier, because most policies require prompt notification and many require you to use their incident response team.
• Do not pay, and do not communicate with them, before anyone has assessed your backups. If your backups are intact and isolated, you likely do not need to.

Do not start deleting the ransom notes or reinstalling machines. Identifying the variant matters, and occasionally a decryptor already exists.

The realistic recovery path, with good backups, is containment, then rebuilding to clean systems, then restoring data. Being able to work again is often same day to next day. Being finished takes longer, because credential resets, determining what was accessed, and any notification obligations all continue afterward.

If you are reading this and it has not happened yet, the question worth answering today is whether your backups could be reached from an encrypted network.