Security incident
Ransomware attack on your business: what to do in the first hour and how to prevent it
If your company's files have been encrypted: disconnect the affected computers from the network straight away without shutting them down, don't pay the ransom, keep the attacker's message and call your IT partner. Secure IT Solutions clients call +40 750 293 932: we respond within their plan's hours, and 24/7 on Premium. Prevention costs far less than recovery: immutable backup, EDR and a tested recovery plan.
What’s included
- 01
Immutable 3-2-1-1-0 backup
Three copies, on two media, one off-site, one immutable and zero errors on verification, so the attacker cannot encrypt the backup.
- 02
EDR on workstations and servers
Detects and stops ransomware-like behaviour on a computer before it encrypts the whole network.
- 03
Tested recovery plan
RPO and RTO set for every critical service and real test restores, so you know how fast you can recover.
- 04
Incident response for clients
Clients with a contract call us directly; we respond within their plan's hours, and 24/7 on Premium. Security packages with SOC include an incident response plan.
- 05
Two-factor authentication and updates
Most attacks get in through stolen passwords or unpatched systems; MFA and planned updates close those doors.
- 06
Staff training
Employees learn to recognise phishing emails, the way most attacks get in.
What to do in the first hour
- Isolate. Disconnect the affected computers and servers from the network (cable and Wi-Fi). Don’t shut them down: memory and logs can help the investigation.
- Don’t pay and don’t negotiate without a specialist.
- Keep the evidence. Photograph the ransom note, write down the time and what you noticed. Don’t delete files.
- Change important passwords (email, banking, admin accounts) from a device that wasn’t affected.
- Call your IT partner. Secure IT Solutions clients call +40 750 293 932; we respond within their plan’s hours, and 24/7 on Premium.
- Report it. Entities covered by NIS2 report significant incidents to DNSC within the legal deadlines; if personal data is affected, you notify ANSPDCP (Romania’s data protection authority), usually within 72 hours. See NIS2 and GDPR compliance.
Who can help
If you are a Secure IT Solutions client, you call us directly: we have access to your systems, backups and recovery plan. We respond within your plan’s hours (8/5 on Basic, 12/7 on Standard), and 24/7 on Premium and on security packages with SOC.
If you are not a client, follow the steps above, report the incident to DNSC and call your current IT provider. Once the incident is over, we can help with an IT security audit and protection so the attack doesn’t happen again.
How to prevent an attack
Ransomware protection is part of our IT support plans and our cybersecurity and business continuity packages: immutable 3-2-1-1-0 backup, EDR, two-factor authentication, planned updates, network segmentation, staff training and a tested recovery plan. We start with a free security audit.
How we work
- Step 1
Free security audit
We check backups, accounts, updates and what would happen in an attack today.
- Step 2
Protection
Immutable backup, EDR, MFA and network segmentation, based on the risks.
- Step 3
Recovery test
We actually restore data in an isolated environment, so we know the plan works.
- Step 4
Monitoring
Continuous monitoring and regular reports, so problems are caught early.
Frequently asked questions
Another question? +40 750 293 932 · office@secureitsolutions.ro
What should I do in the first minutes after a ransomware attack?
Disconnect the affected computers from the network (cable and Wi-Fi), but don't shut them down, so you don't lose evidence. Don't pay the ransom and don't delete anything. Photograph the attacker's message, change the passwords of important accounts from a clean device and call your IT partner. If you are a NIS2 entity, report the incident to DNSC (Romania's National Cybersecurity Directorate) within the legal deadlines.
Should I pay the ransom?
We don't recommend it. Paying doesn't guarantee you get the key or that the data won't be published, and it makes the company a target for new attacks. Safe recovery comes from an immutable, tested backup.
Do you respond if we are not a client?
No. We respond to incidents only for clients with a contract, under the terms of their plan. If you are not a client, follow the steps on this page, report the incident to DNSC and call your current IT provider. After the incident, we can help with a security audit and protection so it doesn't happen again.
How do I prevent a ransomware attack?
Immutable and tested backup, EDR on workstations and servers, two-factor authentication on all accounts, timely updates, a segmented network and staff training against phishing. We implement these in our IT support plans and security packages.
How quickly can I recover my data?
It depends on the backup: with an immutable, tested backup and a recovery plan with a defined RTO, critical services come back within the time set in the plan. Without a clean backup, recovery may be impossible. That's why we test restores before an incident, not after.
Related services
- Cybersecurity and business continuityCybersecurity for businesses combines EDR on workstations and servers, SOC monitoring, immutable backup and a tested recovery plan, so an attack doesn't stop your operations. We start with a free security audit.
- NIS2 and GDPR complianceNIS2 and GDPR compliance means knowing whether the law applies to you, implementing the required technical and organizational measures and having your documentation ready for an inspection. Implementation projects start at €5,000 + VAT.
- IT security auditAn IT security audit shows you where your company is exposed before an attacker finds out: accounts without two-factor authentication, unpatched servers, backups that can't be restored, ports open to the internet. You get a report with risks ranked by severity and a clear list of what to fix.
Quote and free audit
Get a quote: Ransomware attack: what to do
We get back to you within 24 business hours. The first call and the initial audit are free.
Or message us on WhatsApp.
Request a quoteReply within 24 business hours