# Ransomware attack: what to do

> Your company was hit by ransomware? The first-hour steps: isolate, don't pay, keep the evidence, notify DNSC. Plus how to prevent it with immutable backup.

URL: https://secureitsolutions.ro/en/ransomware-attack-what-to-do/  
Updated: 2026-11-12  
Source: secureitsolutions.ro

**Ransomware attack on your business: what to do in the first hour and how to prevent it**

If your company's files have been encrypted: disconnect the affected computers from the network straight away without shutting them down, don't pay the ransom, keep the attacker's message and call your IT partner. Secure IT Solutions clients call +40 750 293 932: we respond within their plan's hours, and 24/7 on Premium. Prevention costs far less than recovery: immutable backup, EDR and a tested recovery plan.

Price: On request, after the free audit (Ransomware protection is part of our security packages and IT support plans; the price depends on the number of computers and servers.)

## What’s included

- **Immutable 3-2-1-1-0 backup.** Three copies, on two media, one off-site, one immutable and zero errors on verification, so the attacker cannot encrypt the backup.
- **EDR on workstations and servers.** Detects and stops ransomware-like behaviour on a computer before it encrypts the whole network.
- **Tested recovery plan.** RPO and RTO set for every critical service and real test restores, so you know how fast you can recover.
- **Incident response for clients.** Clients with a contract call us directly; we respond within their plan's hours, and 24/7 on Premium. Security packages with SOC include an incident response plan.
- **Two-factor authentication and updates.** Most attacks get in through stolen passwords or unpatched systems; MFA and planned updates close those doors.
- **Staff training.** Employees learn to recognise phishing emails, the way most attacks get in.

## What to do in the first hour

1. **Isolate.** Disconnect the affected computers and servers from the network (cable and Wi-Fi). Don't shut them down: memory and logs can help the investigation.
2. **Don't pay and don't negotiate** without a specialist.
3. **Keep the evidence.** Photograph the ransom note, write down the time and what you noticed. Don't delete files.
4. **Change important passwords** (email, banking, admin accounts) from a device that wasn't affected.
5. **Call your IT partner.** Secure IT Solutions clients call **+40 750 293 932**; we respond within their plan's hours, and 24/7 on Premium.
6. **Report it.** Entities covered by NIS2 report significant incidents to DNSC within the legal deadlines; if personal data is affected, you notify ANSPDCP (Romania's data protection authority), usually within 72 hours. See [NIS2 and GDPR compliance](/en/nis2-gdpr-compliance/).

## Who can help

**If you are a Secure IT Solutions client**, you call us directly: we have access to your systems, backups and recovery plan. We respond within your plan's hours (8/5 on Basic, 12/7 on Standard), and 24/7 on Premium and on security packages with SOC.

**If you are not a client**, follow the steps above, report the incident to DNSC and call your current IT provider. Once the incident is over, we can help with an [IT security audit](/en/it-security-audit/) and protection so the attack doesn't happen again.

## How to prevent an attack

Ransomware protection is part of our [IT support plans](/en/it-support-plans/) and our [cybersecurity and business continuity](/en/cybersecurity-business-continuity/) packages: immutable 3-2-1-1-0 backup, EDR, two-factor authentication, planned updates, network segmentation, staff training and a tested recovery plan. We start with a [free security audit](/en/#quote).

## How we work

1. **Free security audit.** We check backups, accounts, updates and what would happen in an attack today.
2. **Protection.** Immutable backup, EDR, MFA and network segmentation, based on the risks.
3. **Recovery test.** We actually restore data in an isolated environment, so we know the plan works.
4. **Monitoring.** Continuous monitoring and regular reports, so problems are caught early.

## Frequently asked questions

### What should I do in the first minutes after a ransomware attack?

Disconnect the affected computers from the network (cable and Wi-Fi), but don't shut them down, so you don't lose evidence. Don't pay the ransom and don't delete anything. Photograph the attacker's message, change the passwords of important accounts from a clean device and call your IT partner. If you are a NIS2 entity, report the incident to DNSC (Romania's National Cybersecurity Directorate) within the legal deadlines.

### Should I pay the ransom?

We don't recommend it. Paying doesn't guarantee you get the key or that the data won't be published, and it makes the company a target for new attacks. Safe recovery comes from an immutable, tested backup.

### Do you respond if we are not a client?

No. We respond to incidents only for clients with a contract, under the terms of their plan. If you are not a client, follow the steps on this page, report the incident to DNSC and call your current IT provider. After the incident, we can help with a security audit and protection so it doesn't happen again.

### How do I prevent a ransomware attack?

Immutable and tested backup, EDR on workstations and servers, two-factor authentication on all accounts, timely updates, a segmented network and staff training against phishing. We implement these in our IT support plans and security packages.

### How quickly can I recover my data?

It depends on the backup: with an immutable, tested backup and a recovery plan with a defined RTO, critical services come back within the time set in the plan. Without a clean backup, recovery may be impossible. That's why we test restores before an incident, not after.

Get a quote: https://secureitsolutions.ro/en/#quote