IT emergency after ransomware: getting back to work.

In a ransomware attack, malicious software encrypts files on computers, servers and often on connected backups too. A ransom demand then appears. The attackers have often been in the network for days or weeks beforehand and have copied data.

The first hours

• Disconnect from the network, do not switch off: Unplug the network cable, turn Wi-Fi off. This preserves the state for later analysis, and the encryption does not spread further.
• Do not connect any backups: Do not connect external drives or NAS devices to infected machines.
• Do not reinstall anything until it is clear what is affected.
• Report: Check your reporting obligations under data protection law and, if applicable, notify your cyber insurer. The police have contact points for cybercrime in such cases.

What we take over

• Assessment: Which systems are encrypted, which backups are clean, which accounts are compromised?
• Secure the drives: Affected drives are saved as a 1:1 copy before anything is changed.
• Clean rebuild: Servers and workstations are reinstalled, not "cleaned". Replacement hardware comes straight from our stock so you can get back to work quickly.
• Renew access: All passwords, remote access and administrator accounts are reset.
• Segment the network: Administration, production, guests and servers in separate zones, so an attack can no longer spread everywhere.
• Rethink backup: at least one copy offline or immutable, tested regularly.

Recover data

To recover data from damaged or encrypted drives we work with our partner lab, which specialises in data recovery. Whether recovery without a key is possible depends on the malware and the condition of the drives and can only be judged case by case.