Ransomware rarely announces itself politely. You notice it when a shared drive stops opening, or when a colleague says every file in a folder now ends in a strange extension. The next hour decides how bad the month gets. Small teams have one real advantage here: fewer systems, fewer people to coordinate, and decisions that can happen in a single call. What they lack is spare capacity. So the plan has to be short enough to remember at 7 a.m. with no coffee, and specific enough that nobody has to improvise.

First 20 Minutes: Contain, Don't Clean

The instinct to start deleting things or reinstalling software is strong. Resist it. Your priorities are stopping the spread, keeping evidence, and getting the right people on the phone.

1. Pull the network cable, not the power cord. If a machine is infected, disconnect it from the network and switch off Wi-Fi. Leaving it powered on can preserve useful information in memory. Shutting it down can destroy that.
2. If more than one machine is hit, take the office offline. The fastest switch is usually the internet connection at the router or the link from your provider. No email, no cloud apps, no remote access — that is the correct trade for a few hours.
3. Kill remote access. Disable VPN accounts, remote desktop access, and any remote support tools. Attackers frequently come in through exactly those doors.
4. Freeze instead of cleaning. Don't wipe drives, don't reinstall, don't run a "cleanup" tool on the affected machines. Preserve at least one infected device as it is.
5. Write down the time you noticed it. That single timestamp is the start of the timeline you'll need for your insurer, your lawyer, and your own understanding of the event.

Don't contact the attacker yet. Don't send money. Don't reply to the ransom note. Those decisions come later, with advice.

Give Five Jobs a Name

Someone has to own each of these, even if one person holds two of them. Ambiguity is where hours disappear.

• Incident lead. Makes decisions, doesn't do hands-on recovery. This separation matters more than it sounds.
• Scribe. Keeps one shared document with timestamps: what was found, who was called, what was decided. It becomes your report later.
• Technical lead. The person or outside firm handling isolation, forensics, and restoration.
• Communications. Drafts messages to staff, customers, and suppliers so nobody else freelances one.
• External liaison. Deals with your insurer, lawyer, IT provider, and law enforcement so the incident lead isn't juggling six phone calls.

Talk on a Channel the Attacker Can't Read

Assume work email and internal chat are compromised until proven otherwise. Move coordination to phone calls or a group chat on personal devices — you can return to normal channels later.

For staff, keep it short: stop using shared drives and email, don't attempt repairs, don't discuss the incident with anyone outside the team. Tell them where to get updates and when. Silence breeds rumor, and rumor reaches customers.

For customers and partners, a brief holding statement is usually better than a detailed one. Something like: we're managing a security incident, some systems are unavailable, we're working with specialists, we'll provide updates at a set time. Avoid guessing at the cause or whether data was taken before you know. If personal data is involved, notification duties and deadlines vary by jurisdiction — get legal advice before you send anything, and don't let urgency push you into promises you can't keep.

Scope the Damage Before You Rebuild

You can't restore your way out of an infection you don't understand. Spend the time to answer a few questions:

• How did it get in? Look for a phishing email still sitting in an inbox, an exposed remote desktop port, an unpatched firewall or VPN appliance, or a contractor's account.
• Which accounts were created or changed? New administrator accounts, disabled antivirus, altered backup jobs, and scheduled tasks are common.
• Are your backups reachable from the infected network? If yes, treat them as suspect. Many ransomware families go after backups first.
• How far did it spread? Map which systems are encrypted, which are merely offline, and which are clean but untrusted.

Keep the ransom note, take screenshots, and note the file extension used. If you have an outside forensics firm, they'll want that evidence intact. If you don't, your insurer often has one on call — ask before you hire.

Recover in a Deliberate Order

Rebuild rather than clean up infected machines. It's slower, and it's the only version you can trust. Restore from backups taken before the infection date, and scan those backups before they touch your network.

Work in this order: identity first, then infrastructure, then the systems that keep money and customers moving, then everything else. That means new passwords for every account, reset multi-factor authentication, new API keys and service tokens, and reissued credentials for anyone with administrative access. Assume every password a user typed on an infected machine is now known to someone else.

Expect a second attempt. Attackers often return a week or two after a "successful" recovery, using access they kept. Watch authentication logs closely for the next month and keep your detection tools running.

Report It, Even When It's Embarrassing

Contact your insurer early — many policies require prompt notice and restrict which vendors you can use. Report to law enforcement as well; national cybercrime units exist in most countries, and a police report is often useful for insurance and for later disputes. If customer or employee data was affected, talk to a lawyer about who must be told and by when. These rules differ widely, so treat any general guidance, including this article, as a starting point rather than a legal answer.

On paying: don't decide alone, don't decide fast, and don't assume payment restores anything. It frequently doesn't, and there can be legal complications depending on who the attackers are. Let your lawyer and insurer weigh in.

The Plan You'll Actually Use

All of this collapses if it only exists in someone's head. Print a one-page card: who calls whom, the insurer's incident hotline, your lawyer, your IT provider, and the order of first actions. Put a copy somewhere physical, because email may be the thing that's down. Keep at least one backup copy offline and disconnected, and test a restore twice a year rather than assuming it works.

Then spend one hour on a tabletop exercise. Read the team a scenario — "finance opens an invoice, by lunch the shared drive is encrypted" — and walk through the first 20 minutes out loud. You'll find the gaps: nobody knows the router's location, the contact list is out of date, two people both think they're the incident lead. Fixing that in a meeting costs an hour. Fixing it during an actual attack costs days.

Photo: StartupStockPhotos / Pixabay