Ransomware is a program that encrypts your company’s files and requires a rescue to return them. It usually appears at a hit: screens with a message, files with strange extensions that don’t open, servers that stop responding. What you do in the first hour decides how much you lose.
1. Aysla the affected teams, without deleting them
Remove the network cable and disable the wifi from the equipment where you see the message. The goal is that the attack does not continue to spread to other computers or to the server. Do not turn them off: in the memory there are clues that serve to know how they entered and, sometimes, to recover the keys.
2. Protect backups
If you have copies on a connected disk or on a network server, disconnect it already. The attackers are searching for the copies to delete them before asking for the rescue. An intact copy is the difference between recovering in days or not recovering.
3. Do not pay or trade on your own.
Paying does not guarantee receiving a key that works, funds new attacks and indicates you as a company that pays. You also don’t answer the attackers without advice: there’s information in that conversation that can be useful for the investigation.
4. Do not delete anything
Neither the ransom note, nor the encrypted files, nor the records. All this is evidence. Also don’t reinstall equipment yet: first you have to understand where the attack entered, or it’s going to pass again.
5. Ask for professional help
An incident response team contains the attack, identifies the entrance door, checks if data has been taken and plans recovery. in Ovnar We take care of urgency at any time. INCIBE It also offers a free cybersecurity assistance line. 017.
6. Notice and notice to whom it corresponds
It is presented to the National Police or the Civil Guard. If the attack affects personal data of customers or employees, it may be mandatory to notify the Spanish Data Protection Agency within a period of time. 72 The Hours. We will help you prepare this notification.
After the attack
Once the activity has been recovered, review what failed: password without two-factor authentication, equipment without update, accessible copies from the network. These are the three points for which the majority of attacks enter, and the three have a simple solution.