A ransomware screen is not the start of the incident. In many cases, an attacker has already spent days or weeks inside the network, locating backups, harvesting credentials and copying sensitive files. Knowing how to recover from ransomware means treating the event as an active security incident, not simply a file-encryption problem. The first decisions made in the next hour can protect your data, customer trust and ability to trade.
For a household, the immediate concern may be irreplaceable photographs, documents or access to online accounts. For a small business, the consequences can include lost bookings, unavailable accounts systems, missed payroll, disrupted suppliers and the risk of stolen customer information being published. A calm, controlled response is essential.
Contain the ransomware before it spreads
If you believe a computer, server or cloud account has been affected, isolate it immediately. Disconnect the device from Wi-Fi and unplug any network cable. Do not shut it down unless instructed by an incident responder, because its memory may contain useful forensic evidence, active encryption keys or details of the attacker’s tools.
Take the following initial actions, in this order where possible:
- Disconnect affected devices, shared drives and network-attached storage from the network.
- Stop scheduled backup jobs and synchronisation services until they have been checked for contamination.
- Prevent staff from logging into affected systems or opening suspicious emails and files.
- Record what you can see: ransom note wording, file extensions, affected devices, times, usernames and any unusual alerts.
Avoid the understandable temptation to reconnect a device to see whether it has recovered. Ransomware can continue encrypting accessible shares, and a compromised device may give the attacker a route into systems that were previously unaffected.
Containment also means considering identity. If an attacker has stolen administrator, email or remote-access credentials, simply removing malware from one machine will not end the incident. From a known-clean device, reset privileged passwords first, revoke active sessions, enforce multi-factor authentication and review recently created accounts. Do not reset every password blindly from a potentially compromised workstation.
Do not pay the ransomware hackers!
A ransom demand is designed to create urgency. It may threaten an imminent data leak, claim that all backups are destroyed or offer a countdown discount. These claims are pressure tactics, not evidence that payment will restore your systems.
Paying does not guarantee file decryption, complete recovery or deletion of copied data. Some people are targeted again because the criminals know payment is possible. There can also be legal and regulatory concerns if funds reach sanctioned individuals or organisations. The decision has serious commercial, legal and ethical dimensions and should be made with specialist advice, not in a rushed exchange with criminals.
Do not communicate from your everyday business email account if it may be compromised. Preserve the ransom note, payment instructions and any chat messages. They can help identify the ransomware family, support law-enforcement reporting and inform the investigation.
Preserve evidence while recovery begins
Keep copies of ransom notes, encrypted sample files and relevant logs. Record the time the issue was discovered, the people who had access, recent changes to IT systems and any suspicious emails, remote-access activity or failed login alerts. Do not delete logs or wipe affected equipment in the rush to get back online. That can remove the evidence needed to determine whether personal data or business information was taken.
This matters because modern ransomware is commonly double extortion. Criminals may steal files before encryption and threaten publication even if you can restore from backups. If customer, employee or financial information may have been exposed, you may need to assess reporting obligations to the Information Commissioner’s Office. Serious cybercrime should also be reported through the appropriate UK channels, including Action Fraud where relevant.
A forensic review should look for the initial access route. Common causes include phishing, reused passwords, exposed remote desktop services, vulnerable software, stolen cloud credentials and unmanaged third-party access. Without finding and closing that route, restoring systems can put them back into the attacker’s hands.
How to recover from ransomware with clean backups
A backup is only useful if it is intact, accessible and free from the attacker’s changes. Before restoring anything, check when the backup was created and whether it predates the intrusion rather than merely the encryption event. Attackers often remain undetected long enough to corrupt or delete backup copies.
The safest approach is to build or prepare a clean recovery environment, then restore in priority order. Start with core identity services, essential business applications and the data required to operate. Bring systems back in controlled stages, checking for suspicious accounts, malware indicators and unauthorised remote tools before reconnecting each one to the wider network.
Do not restore every file automatically. A full restore may reintroduce malicious scripts, infected documents or attacker-created accounts. Test recovered systems in isolation where possible. Confirm that endpoint protection is active, operating systems and applications are patched, administrative access is tightly controlled and monitoring is producing useful alerts.
If you have no usable backup, specialist assistance may still identify whether a legitimate decryption option exists for the ransomware strain. Never upload sensitive samples to unknown websites or download supposed decryptors from unverified sources. Criminals frequently use fake recovery tools to infect victims a second time.
Bring the business back safely, not just quickly
Business continuity is about more than making devices switch on. Decide which services must return first: taking customer payments, accessing bookings, communicating with staff, processing orders or meeting payroll. Agree temporary manual processes so that the organisation can continue operating without pushing unverified systems back into service.
Communication should be factual and proportionate. Staff need clear instructions on which systems are safe, how to report concerns and what information must not be shared externally. Customers and suppliers may need to know about delays, but speculation about the cause or scale of the incident can create avoidable reputational harm. Keep a written incident timeline and nominate one person to coordinate operational updates.
For small organisations without an in-house security team, this is where hands-on incident response changes the outcome. North Devon Cybersecurity can support containment, malware removal, data recovery and a return to service, helping decision-makers separate urgent facts from attacker pressure.
Reduce the chance of a second attack
Once services are stable, treat the incident as intelligence. Review exactly where detection failed, which controls slowed the attacker and which business decisions increased exposure. A recovery plan that ends at restored files leaves the same weaknesses available for the next intrusion.
Prioritise backups that are separated from the main network and regularly tested through real restoration exercises. Apply security updates promptly, remove unnecessary remote access, use multi-factor authentication for email and administrator accounts, and limit permissions so one stolen account cannot reach everything. Endpoint monitoring, centralised logging and alert review are equally valuable because early detection can turn a full encryption event into a contained compromise.
Staff awareness also has a place, but it is not a substitute for technical controls. People will occasionally click convincing messages or reuse a password. Good security design assumes that mistakes happen and limits the damage they can cause.
The strongest recovery position is built before an attacker arrives: verified backups, clear decision-making authority, tested contacts and a response process that staff can follow under pressure. If ransomware strikes, protect the evidence, isolate the threat and restore only when you are confident the attacker no longer has a way back in.
