It's 4:50 on a Friday afternoon when someone notices the shared drive is full of files with a strange new extension, and a text file on the desktop says everything is encrypted. Nobody on the team has handled this before. The next few hours decide whether this becomes a bad week or a company-ending event.

Small teams rarely have an incident response firm on retainer or a printed runbook in a drawer. What follows is the order experienced responders tend to work in: contain first, preserve evidence second, communicate third, and only then start rebuilding. Adapt it, print it, and store it somewhere you can reach when email and the file server are gone.

Stop the Spread, Don't Wipe Anything

Encryption is often a matter of minutes, but attackers usually spend longer moving sideways and stealing data. Assume they still have a foothold somewhere you haven't looked yet.

1. Disconnect, don't shut down. Pull the network cable or disable Wi-Fi on affected machines. Leave them powered on if you can — memory can hold encryption keys and evidence that vanishes on reboot.
2. Close the boundary. Disable VPN accounts, remote desktop gateways, and any remote access you can switch off cleanly. Unplug backup appliances from the network so they can't be reached or encrypted.
3. Turn off shared drives and mapped folders so encryption can't crawl from one machine to the next.
4. Don't reply to the ransom note from a company address. Nothing the attackers say can be trusted, and engagement confirms they reached a live mailbox.
5. Write down what you know. Time of discovery, who noticed, what the note says, which systems are affected, the file extension on encrypted files. This becomes the spine of your timeline.

Assume an Account Is Already Compromised

Most intrusions at small organizations start with a phished mailbox or an exposed remote access service. From a clean device — a laptop that was never on the affected network — reset passwords for email administrators, finance, and anyone with mailbox delegation. Revoke active sessions and refresh tokens, not just passwords, or the attacker keeps the access they already hold.

Then check the quiet places: mailbox rules that forward or delete messages, newly created accounts, new multi-factor devices, new application passwords and API keys. Work in order of power — accounts that can modify other accounts first, everyone else after.

Preserve What You'll Need Later

Before anyone starts "cleaning up," take pictures. Screenshot the ransom note, the file listing, the banner on the desktop. Copy the note to an external drive along with firewall, VPN, and email gateway logs. Insurers, counsel, and law enforcement will ask for these, and they're much easier to collect now than after a reimage.

If you have the skills in-house or through a provider, image one or two affected machines. If not, at minimum keep everyone from running cleanup utilities or deleting encrypted files until someone with incident response experience says otherwise. Public decryptors exist for some ransomware families, and they work far better on an intact system.

Communication: One Voice, Inside and Out

Inside the team

Appoint one person to run the response and one to communicate. Everyone else takes tasks, not speculation. If email is suspect, move coordination to a channel you trust — a phone bridge or a group chat on personal devices. Tell staff plainly: don't post about it, don't contact the attackers, and don't go poking at affected machines out of curiosity.

Give people specific jobs. Vague instructions produce four people rebooting servers at once, which is how evidence disappears.

Outside the organization

• Your cyber insurer. Call early. Policies commonly require prompt notice and often include access to an incident response firm and negotiators. Delays can affect coverage.
• Legal counsel. Breach notification duties depend on your jurisdiction and the data involved. A lawyer who handles incidents can tell you who must be told and by when.
• Law enforcement. Reporting is worth doing and required in some places. Keep expectations realistic about response times.
• Customers and partners. A short, factual holding statement usually beats a week of silence. Don't speculate about data theft until you have evidence.

If personal, financial, or health data is involved, talk to counsel before drafting any customer message.

Recovery: Fix the Door Before You Refurnish

Restoring from backup is the goal, but restoring into the same password-only, unpatched environment invites a second attack. Spend an hour working out how they got in. Typical answers: a VPN account with no multi-factor authentication, remote desktop exposed to the internet, a mailbox that gave up credentials to a phishing page, or an unpatched internet-facing appliance.

Then rebuild in layers — identity first with new administrator credentials and MFA everywhere, then critical servers, then endpoints. Test backups before trusting them: confirm they exist, that they're offline or immutable, and that they actually restore. Backups sitting on the same network are frequently encrypted along with everything else.

On paying: responders and law enforcement generally discourage it. Payment funds criminal groups, doesn't guarantee recovery, and can carry legal risk depending on the recipient. If your team is seriously weighing it, involve counsel before making contact.

The First-Day Checklist

1. Isolate affected machines; leave them powered on.
2. Disable VPN, remote access, and shared drives. Unplug backups.
3. Reset and revoke credentials from a clean device; check mailbox rules and new accounts.
4. Copy the ransom note, logs, and file listings to separate media.
5. Notify your insurer and counsel; decide on law enforcement reporting.
6. Name one incident lead and one communicator.
7. Find the entry point before restoring anything.
8. Restore from verified offline backups; rebuild identity first.
9. Keep a timeline of decisions, times, and who did what.
10. Patch the entry point, enforce MFA, and book a review for next week.

Afterwards, Fix the Two Things That Matter

Once systems are stable, hold a two-hour review with everyone involved and read the timeline out loud — the gaps will be obvious. Then fix the two controls that prevent most repeat incidents: multi-factor authentication on every remote and email account, and backups that are offline or immutable and have been restored from at least once. Keep a printed copy of this checklist and walk through it in a tabletop exercise once a year. A team that has rehearsed for an hour will do considerably better than a team reading this for the first time at 4:50 on a Friday.

Photo: StartupStockPhotos / Pixabay