What to Do After a Ransomware Attack: A Step-by-Step Guide for UK Businesses

If you are in the middle of a ransomware incident, the short answer is this: isolate the affected machines from the network, call your incident response contacts, report the incident, and do not rush to restore or pay. What you do in the first few hours shapes how bad the next few weeks get. This guide covers what to do after a ransomware attack, in the order that matters, based on UK and US government guidance.

Here is the practical version. Print it, pin it up, and use it as a starting point for your own plan before you ever need it. Planning ahead makes the next ransomware attack far less damaging.

What should you do first after a ransomware attack?

Cut the infected devices off from the network. The National Cyber Security Centre (NCSC) tells organisations to immediately disconnect infected computers, laptops or tablets from all network connections. That means wired, Wi-Fi and mobile. In a severe case you may need to switch off Wi-Fi, disable core network equipment and cut internet access too.

Speed matters, but so does staying calm. Attackers are often still inside the network when the ransom note appears. The US agency CISA advises coordinating the isolation by phone rather than email, so the intruders do not see that you have spotted them and push ransomware onto more machines.

Should you switch the machines off?

Not unless you have no other way to disconnect them. CISA says powering devices down should only happen when isolation is not possible, because it destroys evidence held in memory. That evidence can show how the attackers got in and what they took. If you can unplug a network cable or pull a device off Wi-Fi, do that instead.

Who do you need to tell after a ransomware attack?

Several groups, and the clock is already running on some of them. Work through this list while the technical team contains the damage.

• Your incident response plan owner and senior leadership. Someone has to make decisions and keep a log of them.
• Your IT provider or managed security provider, if you use one.
• Your cyber insurer. Many policies require early notice and may include a response team. Check before you spend money on outside help.
• The authorities. The NCSC runs a service that tells you where to report a cyber incident in the UK.
• The ICO, if personal data is at risk. More on that below.

When do you have to report to the ICO?

If the attack is likely to put people’s rights and freedoms at risk, you must tell the Information Commissioner’s Office. The ICO says a notifiable breach must be reported without undue delay and no later than 72 hours after you become aware of it. If you cannot finish your investigation in that time, you can send the details in phases, but the first report still has to arrive on time.

One catch is easy to miss. The NCSC reporting service does not pass your details to the ICO, so a personal data breach needs its own report. If you decide a breach does not need reporting, write down why. The ICO expects you to keep a record of every breach, reported or not.

Should you pay the ransom after a ransomware attack?

The NCSC and UK law enforcement do not support paying. Their reasons are plain. Payment does not guarantee you get your data back, your devices can stay infected, the money goes to criminal groups, and you become a more likely target next time.

Real life is messier than that, especially if the business cannot trade. Treat the choice as a board-level call that uses legal advice and your insurer’s input, and make it after you know what was taken and whether your backups work. Paying also does nothing for your data protection duties. You still have to assess and report the breach.

How do you investigate and keep the evidence?

Investigation starts while you are still containing the incident. CISA recommends you:

• review security tools and logs for earlier signs of compromise, such as new privileged accounts or unexpected remote access;
• capture images and memory from a sample of affected devices;
• keep logs, malware samples and indicators of compromise;
• list which systems matter most to the business and restore those first.

For cloud resources, take a snapshot of volumes before you change anything. Work like this is slow and specialist. The NCSC recommends that UK organisations use an NCSC-assured cyber incident response provider, and it keeps a list of them. Bring one in early if you do not have in-house expertise.

How do you recover safely?

Do not just restore everything and reconnect. Recovery after a ransomware attack should follow a set order. The NCSC sets out a clear order of work for each affected device:

1. Reset passwords, starting with administrator and system accounts. First check that you will not lock yourself out of systems you need for recovery.
2. Wipe the infected device and install a fresh operating system.
3. Restore data from a backup only when you are very confident that the backup and the device are both clean.
4. Build and update the system on a clean network before it joins the main one.
5. Install and run antivirus, then reconnect.
6. Watch network traffic and run scans to catch any remaining infection.

CISA adds two steps that people forget. Find out how the attackers kept access, so they cannot walk back in, and patch the weakness they used. Also ask law enforcement whether a free decryptor exists for your ransomware variant, because researchers sometimes release one.

Why do backups so often fail at this point?

Because ransomware goes looking for them. CISA notes that attackers often try to find and encrypt or delete backups they can reach. A backup that sits on the same network, with the same admin password, may be gone before you notice. The NCSC’s advice is to keep a recent offline backup of your most important files and data, and to test that you can restore from it.

How can you stop it happening again after a ransomware attack?

Once the business is running again, close the door the attackers used. The usual routes in are exposed remote access, unpatched systems, stolen passwords and phishing. A vulnerability scan finds known weaknesses cheaply and often. An attacker’s-eye test goes further and shows how those weaknesses chain together, which is what happened in your incident.

This is where internal network testing earns its keep. It shows how far a criminal could move once one laptop is compromised, and whether your backups and domain controllers are within reach. If you are weighing up whether this is worth the money, our plain guide on whether you need a penetration test sets out the typical triggers.

Basic controls help as well. The Cyber Essentials scheme covers firewalls, secure settings, patching, access control and malware protection, which are the gaps ransomware crews lean on.

If you would like an expert to test your defences before an attacker does, Aardwolf Security can scope a penetration test around your set-up. You can get in touch for a no-obligation chat.

Ransomware attack FAQs

Can you recover files without paying?

Often, yes. Clean offline backups are the best route. Some ransomware families have free decryptors, so ask law enforcement before you assume your files are lost.

How long does recovery take after a ransomware attack?

It depends on your backups, how many systems were hit and how clean your restore process is. Expect days for a small, well-prepared business and weeks for a large one. Rebuilding on a clean network is slower than restoring, but it is safer.

Do you need to tell customers?

If personal data was likely at risk of harm, data protection law may require you to tell the affected people as well as the ICO. Take advice, and keep your messages factual and consistent.

Is a ransomware attack always a data breach?

No, but you should assume so until you know otherwise. Many gangs steal data before they encrypt it, so check for exfiltration in your logs before you decide a report is not needed, and record your reasoning either way.

Who should be on your incident response team?

Someone to lead, someone technical, someone who talks to staff and customers, and a person who keeps the log. Add legal advice, your insurer and an assured response provider on speed dial.