Most owners have never lived through a ransomware attempt, and the picture in their heads comes from movies: flashing red screens, a ticking clock, chaos in the hallway. Real incidents tend to look different. They begin quietly, and what happens in the first hour often shapes how the next several weeks go. This article walks through that first hour in a calm, step-by-step way, so it is not a surprise if you ever face something similar.
The first few minutes: a quiet signal
Imagine a small accounting office with a handful of employees. It is a Thursday evening in the middle of tax season, and most people have gone home. One bookkeeper is still at her desk when she opens an attachment from what looked like a routine client email. Nothing visible happens. No warning box appears and the document simply looks blank.
In the background, though, her computer has started running commands it has never run before, and a built-in administrative tool has launched that nobody in the office normally uses. On their own, each of these events might be harmless. Together, at this hour and on this machine, they look unusual. The lightweight software on her laptop records the behavior and sends it to a 24/7 security operations center, where an analyst sees the alert come in.
Investigating and isolating
The analyst's first job is not to react, but to understand. Is this a false alarm or a real problem? They review the recorded history on that laptop: which program opened the attachment, what it launched next, and where it tried to connect. The pattern looks consistent with the early stages of a ransomware attempt, in which an intruder tries to gain a foothold, look around, and prepare to lock up files.
At this point time matters, so the next steps happen in a particular order.
- Confirm that the behavior is genuinely suspicious rather than a software update or a quirk of the office's setup.
- Isolate the affected laptop from the network. The device stays on, so the evidence stays intact, but it can no longer reach other computers or the shared files.
- Check other devices for similar activity, to see whether anything else in the office has been touched.
- Begin a written record of what was seen and what was done, with times, for the people who will need it later.
Isolation is the important step. Ransomware causes the most damage when it can travel from one computer to the rest of the network, and cutting off the first machine can help keep the problem small. It does not make the problem disappear, and it does not promise that nothing else was affected, which is why the checking continues.
The phone call, and what to do next
Once the laptop is isolated, someone calls the owner. A good call is short and plain: here is what we saw, here is what we have done, here is what is still being checked, and here is what we need from you. There is no jargon and no drama. A good security partner also brings in the office's IT provider, who knows how the network is built.
If you are the owner receiving this call, it is natural to feel your stomach drop. Take a breath. The most useful things you can do are simple, and most involve restraint.
Start with what to do.
- Stay reachable, and have one person act as the point of contact so instructions do not get crossed.
- Leave the isolated laptop alone. Do not sign in to it, and do not let anyone try to fix it.
- Write down what you know: who used the machine, what they opened, and when.
- Preserve evidence. Do not delete emails, files, or logs, even if they look like the source of the trouble.
- Contact your cyber insurance carrier if you have a policy, since many require prompt notice. Your policy will say what is expected.
- Consider contacting legal counsel, especially if client, patient, or financial information may be involved, because notification duties can apply. A lawyer can tell you what your obligations are. We cannot and do not give legal advice.
Then consider what not to do, because this is where well-meaning people often make things worse.
- Do not power off every computer in a panic. Shutting a device down can erase information in its memory that investigators find useful. Disconnecting a machine from the network, as directed by your security team, is usually a better first step than a hard shutdown.
- Do not contact the attackers, and do not pay anything on your own. Decisions about communicating with criminals belong with your legal counsel, your insurer, and experienced incident responders, not with a stressed owner late in the evening.
- Do not start restoring from backups right away. If the intruder is still in the network, restoring can simply hand them the new files.
After the first hour: recovery and lessons
In our hypothetical, the damage is limited to a single laptop, and the analyst's review suggests that the intruder never reached the shared files. That will not always be the case, which is exactly why the checking matters. The bookkeeper's laptop is wiped and rebuilt, her passwords are changed, and the office's IT provider confirms that the backups are intact. By the next morning, the office is working again, with a short and readable report describing what happened.
A less fortunate version of this story is easy to imagine. If the same email had landed at 2 a.m. on a weekend, with nobody watching the alerts, the intruder might have had hours to explore the network before anyone noticed. The difference is usually speed and someone paying attention.
The better incidents end with a calm review. What did the email look like, and could staff have spotted it? Should that bookkeeper have had the ability to launch that tool at all? Were the backups easy to reach, and had anyone tested them? Each answer becomes a small improvement.
An owner's checklist for today
You cannot prepare for every scenario, but you can do a handful of ordinary things now that make a hard day much easier.
- Write a contact list and keep a paper copy: your IT provider, security provider, insurer's claim line, and attorney, with after-hours numbers.
- Test your backups. Ask your IT provider to show you a real file being restored, and confirm at least one backup copy is kept separate from your main network.
- Turn on multi-factor authentication for email and any system that holds sensitive data, so a stolen password alone is not enough.
- Know who to call, and who decides. Agree in advance who has authority to approve decisions if you are unreachable.
- Find your cyber insurance policy and read what it asks you to do, and when.
- Tell your team what to do when something looks wrong: stop, leave the computer on, and call a named person rather than trying to fix it.
How Cyberintell can help
Cyberintell provides managed endpoint detection and response for small and mid-sized businesses in Louisiana and Mississippi. A 24/7 security operations center watches the devices in your office, investigates what looks unusual, can isolate an affected device, and explains what happened in plain English while working alongside your IT provider. If you would like to know how prepared your firm is today, our free security assessment is a good place to start.
