Cybersecurity

Ransomware Attack Response: What to Do When Your Business is Hit

Hit by ransomware? What to do in the first 30 minutes, who to contact in the UK, whether to pay, and how to recover and prevent a repeat.

By Omega IT29 January 2026Updated 28 October 20266 min read

On this page
Ransomware attack response and recovery guide

Your Business Has Been Hit by Ransomware - What Now?

Discovering your business has fallen victim to a ransomware attack is terrifying. Files are encrypted, systems are locked, and criminals are demanding payment. In these critical moments, the actions you take can mean the difference between recovery and disaster.

This guide provides a clear, step-by-step ransomware response plan to help UK businesses navigate this crisis effectively.

Hit by ransomware?

See how our cyber security team helps businesses respond, recover and prevent a repeat.

Explore cyber security

Talk to our team
or call 0800 254 5458

Immediate Actions: The First 30 Minutes

Time is critical. Here's what to do immediately when you discover a ransomware infection:

1. Don't Panic - But Act Fast

Stay calm and focused. Panic leads to mistakes that can make the situation worse.

2. Disconnect Affected Systems Immediately

This is the most critical step to stop ransomware spreading:

  • Unplug network cables from affected computers
  • Disable Wi-Fi on infected devices
  • Do NOT power off the computers yet (forensic evidence may be needed)
  • Disconnect from VPN if connected remotely
  • Isolate network segments if possible

3. Disconnect Backup Systems

Immediately disconnect any backup drives or systems to prevent the ransomware encrypting your backups:

  • Unplug external backup drives
  • Disconnect cloud backup sync
  • Isolate backup servers from the network

4. Document Everything

Take photos of:

  • Ransom notes on screens
  • File extensions on encrypted files
  • Any error messages
  • The time you discovered the attack

5. Alert Your IT Team or Provider

Contact your IT support immediately. If you have a managed IT provider like Omega IT, call our emergency line. We can begin incident response procedures straight away.

The First Hour: Containment and Assessment

6. Identify the Scope of the Attack

Work with your IT team to determine:

  • Which systems are affected?
  • Which systems are still clean?
  • What data has been encrypted?
  • Are backups intact and accessible?
  • When did the attack likely begin?

7. Identify the Ransomware Variant

Knowing the specific ransomware helps determine recovery options:

  • Check the ransom note for identifying information
  • Note the file extensions added to encrypted files
  • Use tools like ID Ransomware (id-ransomware.malwarehunterteam.com) to identify the variant
  • Some older variants have free decryption tools available

8. Preserve Evidence

Before any recovery attempts:

  • Create forensic images of affected systems if possible
  • Save copies of ransom notes
  • Preserve system logs
  • Document the attack timeline
  • This evidence may be needed for insurance claims or law enforcement

Who to Contact After a Ransomware Attack

Law Enforcement

Report the attack to:

  • Report Fraud (England, Wales and Northern Ireland), which replaced Action Fraud in December 2025: reportfraud.police.uk or 0300 123 2040. Report Fraud asks businesses under a cyber attack to call this number immediately.
  • Police Scotland (Scotland): call 101
  • National Cyber Security Centre (NCSC): report significant incidents through the NCSC's incident reporting service at report.ncsc.gov.uk

Your Cyber Insurance Provider

If you have cyber insurance, contact them immediately:

  • Many policies have 24/7 incident response hotlines
  • They may provide access to specialist incident response teams
  • Document everything for your claim
  • Follow their guidance on ransom payment decisions

Consider contacting a lawyer experienced in cyber incidents, especially if:

  • Customer or employee data may have been stolen
  • You operate in regulated industries
  • You're considering ransom payment

Data Protection Authority

Under UK GDPR, you may need to report to the ICO within 72 hours if personal data has been compromised:

  • Information Commissioner's Office (ICO): ico.org.uk
  • Report if there's a risk to individuals' rights and freedoms
  • Document your breach assessment

Be ready before it happens

Our team can put the detection, backups and response plan this guide recommends in place.

Explore cyber security

Talk to our team
or call 0800 254 5458

Should You Pay the Ransom?

This is the most difficult decision. Here's what to consider:

Reasons NOT to Pay

  • No guarantee of recovery: Many victims pay and never receive decryption keys
  • Funds criminal activity: Payment encourages more attacks
  • You become a target: Paying makes you a known payer for future attacks
  • May be illegal: Paying certain groups violates sanctions laws
  • Data may already be stolen: Payment doesn't prevent data being sold

When Businesses Consider Paying

  • No viable backups exist
  • Business survival depends on immediate recovery
  • Critical data cannot be recreated
  • Insurance covers the payment

Our Recommendation

Do not pay unless absolutely necessary. Work with your IT provider and cyber insurance to explore all recovery options first. If you must pay, use experienced negotiators - never deal directly with attackers.

Recovery: Getting Your Business Back Online

Option 1: Restore from Backups

This is the preferred recovery method if clean backups exist:

  1. Verify backups are clean - scan before restoring
  2. Rebuild systems from scratch - don't just restore over infected systems
  3. Restore data from the most recent clean backup
  4. Test restored systems before reconnecting to network
  5. Update all passwords across the organisation

Option 2: Decryption Tools

Check if free decryption tools exist:

  • No More Ransom Project: nomoreransom.org
  • Tools exist for many older ransomware variants
  • Your IT provider can check for available decryptors

Option 3: Professional Data Recovery

Specialist firms may be able to recover some data through forensic techniques.

Post-Incident: Preventing Future Attacks

Once recovered, take immediate steps to strengthen your defences:

Immediate Security Improvements

  • Reset ALL passwords - especially admin and service accounts
  • Enable MFA (Multi-Factor Authentication) everywhere
  • Patch all systems - apply outstanding security updates
  • Review admin access - remove unnecessary privileges
  • Improve email security - consider Proofpoint or similar

Long-Term Security Strategy

  • Implement MDR (Managed Detection and Response) for 24/7 monitoring
  • Deploy EDR (Endpoint Detection and Response) on all devices
  • Regular security awareness training for all staff
  • Test backups regularly - including full restoration tests
  • Develop an incident response plan before the next attack
  • Consider cyber insurance if you don't have it

Want help putting this in place?

Omega IT can set up the protections this guide covers.

Explore cyber security

Talk to our team
or call 0800 254 5458

Ransomware Response Checklist

Print this checklist and keep it accessible:

Immediate (0-30 minutes)

  • ☐ Disconnect affected systems from network
  • ☐ Disconnect backup systems
  • ☐ Document/photograph ransom notes
  • ☐ Alert IT team or provider
  • ☐ Do NOT power off systems

First Hour

  • ☐ Assess scope of infection
  • ☐ Identify ransomware variant
  • ☐ Preserve evidence
  • ☐ Contact cyber insurance

First 24 Hours

  • ☐ Report to law enforcement
  • ☐ Assess UK GDPR reporting requirements
  • ☐ Begin recovery planning
  • ☐ Communicate with stakeholders

Get Help Now

If your UK business is experiencing a ransomware attack, contact Omega IT immediately. Our team can provide:

  • Emergency incident response
  • Forensic analysis and containment
  • Recovery and restoration support
  • Post-incident security improvements

Don't face a ransomware attack alone. Call us now on 0800 254 5458 for immediate assistance.

Frequently asked questions

Should you pay the ransom?

The NCSC (National Cyber Security Centre) and law enforcement consistently advise against paying ransoms. Payment does not guarantee you will receive working decryption keys — a significant proportion of victims who pay either receive non-functional keys or are targeted again having demonstrated willingness to pay. Before considering payment, determine whether working backups exist, whether a free decryption tool is available (the No More Ransom project at nomoreransom.org maintains a database), and take legal advice.

How do businesses recover from ransomware without paying?

Recovery without payment depends on having clean, verified backups that pre-date the attack and were not accessible to the ransomware — meaning they were kept offline, on immutable storage, or in a cloud service the ransomware could not reach. The recovery process involves wiping affected systems, rebuilding from a known-clean baseline, and restoring data from backup. Businesses with daily, tested, offsite or cloud backups can often recover in days; those relying on local backups that were also encrypted may have little to restore from.

How does ransomware get into a business's systems?

The most common entry points are: phishing emails that trick a user into clicking a malicious link or opening an attachment; compromised credentials used to log into remote access services (VPN, RDP) exposed to the internet; and exploitation of unpatched vulnerabilities in internet-facing systems. Once inside, ransomware typically spends time — sometimes weeks — moving laterally across the network before triggering the encryption. This dwell time is why good monitoring (MDR/SOC) can catch an attack in progress before encryption begins.

Do I need to report a ransomware attack to the ICO?

If the attack involved access to or encryption of personal data — customer records, employee information, or any other personally identifiable data — you must assess whether it meets the threshold for reporting to the ICO under UK GDPR. Ransomware that encrypts personal data typically meets this threshold. You have 72 hours from becoming aware of the breach to report to the ICO if the threshold is met. Take legal advice if you are uncertain.

How can a business prevent ransomware attacks?

No single control eliminates ransomware risk, but layering the following reduces it substantially: enforce multi-factor authentication on all accounts; keep all software and operating systems patched and up to date; train staff to recognise phishing; maintain tested, offline or immutable backups; deploy endpoint detection and response (EDR) software; and avoid exposing RDP or other remote access services directly to the internet. Businesses with 24/7 security monitoring (MDR/SOC) can detect ransomware activity during the dwell period — before encryption begins.

Build your ransomware defences

Talk to Omega IT about protecting and recovering your business.

Explore cyber securityAsk about IT support

Talk to our team
Freephone 0800 254 5458Local rate 03333 580 300