A ransomware attack rarely announces itself. It usually starts with a normal looking email, a link, or a download. By the time anyone notices, files are locked and the people who run your business cannot reach the data they need. For a small company, the hours that follow matter as much as anything done beforehand to prepare. A workable ransomware response for small business owners comes down to a short list of actions taken in the right order.
The stakes are higher than many owners assume. A University of Maryland Carey School of Law article published in April 2023 reported that 82 percent of ransomware attacks are upon small to midsize businesses, and that once hit with a cyberattack, 1 in 5 businesses completely cease operation. The difference between a bad week and a closed business often comes down to how quickly and calmly the response unfolds.
Step 1: Isolate the affected systems
Containment comes first. Ransomware spreads across shared drives, mapped network folders, and connected devices, so every minute a compromised machine stays online increases the chance that more of your business gets locked down. An incident response plan should call for immediate system isolation, which means separating affected machines from the rest of the network as fast as possible.
If you work with an IT provider, call them now rather than waiting for a convenient moment. If you do not have one, designate a single person to lead the response and make sure everyone else knows who that is. One point of coordination prevents the confusion of several employees pulling cables or rebooting machines at the same time.
Step 2: Identify the malware and the scope of the damage
Ransomware response and recovery involves identifying malware and minimizing the harm inflicted on affected systems. In practical terms, that means answering a few questions before making any large decisions:
- Which systems are encrypted and which are still working?
- What type of ransomware is it, if that can be determined?
- What data is affected, and does any of it involve customer, patient, employee, or client records?
- How did it get in, and is that entry point still open?
Those answers shape everything that follows, from notification duties to whether restoration is possible from the backups you already have.
Step 3: Report the attack to the authorities
Federal guidance for small businesses is direct on this point: contact the authorities and report the attack. Reporting also connects you with people who have seen the same attack pattern before, which can shorten recovery. The CISA Stop Ransomware Guide recommends that organizations create, maintain, and regularly exercise a basic cyber incident response plan and an associated communications plan that includes response and notification steps.
Businesses in regulated sectors such as healthcare, financial services, or government contracting may have notification obligations that go beyond law enforcement. Review the requirements that apply to your industry with legal counsel before deciding what to send, to whom, and when. Confirm current requirements with the relevant official source rather than relying on a template you found online.
Step 4: Think carefully before paying a demand
Attackers ask for money or cryptocurrency, and they make the request sound simple. It is not. Even if you pay, you do not know whether the cybercriminals will keep your data or destroy your files. Meanwhile, sensitive details about your customers, employees, and company are now in criminal hands, and a payment does not undo that exposure.
Payment is a business decision, not a technical fix. Bring in legal counsel and law enforcement before any money moves, and understand that paying can fund the next attack, possibly one aimed at your own business.
Quick reference: first actions after a ransomware attack
| Action | Why it matters |
|---|---|
| Isolate affected systems | Stops the malware from spreading to shared drives and other devices |
| Identify the malware and scope | Shows what is encrypted and what data is involved |
| Contact the authorities | Federal small business guidance calls for reporting the attack |
| Alert your staff | Employees need to know what to avoid while systems are down |
| Assess your backups | Clean backups determine whether you can restore without paying |
| Document the timeline | Supports the response and notification steps in your plan |
Step 5: Restore from clean backups
Backups are the reason many small businesses recover without paying a ransom. Small businesses can strengthen ransomware protection by creating a clear response plan and investing in an affordable, reliable backup solution. The word clean matters here. If a backup was connected to the infected network, it may be encrypted as well. Verify the backup before you restore, and bring systems back in a controlled sequence rather than pushing everything online at once.
Step 6: Communicate with employees and customers
People fill silence with rumor. Tell your staff what happened at the level of detail they need, what they should and should not do with their devices, and where to send questions. If customer or patient data was involved, the notification steps in your communications plan tell you who needs to hear from you and what the message should say. Keep messages factual and avoid speculating about the attackers or the cause until the facts are confirmed.
What to do in the weeks after the attack
Recovery is not finished when the last server comes back online. Attackers often leave a way back in, and a second incident shortly after the first is a common pattern. Use the following weeks to close the gaps that made the first one possible.
- Change credentials for email, banking, and line of business applications, and review who holds administrative access.
- Confirm that security software is current and running on every device, including laptops used at home.
- Review backups to confirm they are isolated, tested, and complete.
- Walk through the incident response plan and record what actually happened versus what the plan assumed.
Building ransomware response into daily operations
The best approach to reducing ransomware risk is a layered approach to security, which means using more than one security measure rather than trusting a single tool. That layering has to cover your people too. FTC small business guidance points to alerting staff and teaching them how to avoid phishing scams, since scam emails and infected websites that download malicious software are common infection routes. Security software with real time protection, kept updated, is another layer, alongside tested backups, email filtering, and prompt patching.
Prevention lowers your odds. It does not remove the need for a response plan. CISA’s guidance is to create, maintain, and regularly exercise a basic incident response plan and a communications plan covering response and notification. Exercises matter because a plan nobody has practiced tends to fall apart in the first ten minutes of a real incident.
Where a managed provider fits
Small businesses rarely have a security team waiting for the phone to ring. A managed IT provider can maintain monitoring, keep security tools updated, verify backups, and act as the first call when something looks wrong. The value during a ransomware event is speed: someone who can isolate systems, identify the malware, and begin restoration while the owner focuses on customers, staff, and the decisions only the owner can make.
Frequently Asked Questions
Should a small business pay a ransomware demand?
Payment carries no guarantee. The FTC notes that even if you pay, you do not know whether the cybercriminals will keep your data or destroy your files, and sensitive details about your customers and employees are already in criminal hands. Treat payment as a last resort and involve legal counsel and law enforcement before any funds move.
What is the first thing to do after a ransomware attack?
Isolate the affected systems. Immediate system isolation is a core containment step in an incident response plan, because ransomware spreads through shared drives and connected devices. Once systems are separated, identify the malware and the scope of the damage, then contact the authorities and report the attack.
Do small businesses really need an incident response plan?
Yes. The CISA Stop Ransomware Guide recommends creating, maintaining, and regularly exercising an incident response plan along with a communications plan that includes response and notification steps. A written plan tells employees who to call, who leads the response, and how to communicate, which removes guesswork during a stressful event.
How can a small business reduce ransomware risk?
Use a layered approach, meaning more than one security measure rather than a single tool. Keep security software current, train staff to recognize phishing scams and malicious downloads, maintain tested backups, and review the incident response plan regularly. Many security suites offer real time protection from malware when they are kept updated.
What percentage of ransomware attacks target small businesses?
A University of Maryland Carey School of Law article published in April 2023 reported that 82 percent of ransomware attacks are upon small to midsize businesses, and that 1 in 5 businesses completely cease operation after a cyberattack. Those figures explain why response planning matters as much for a small company as for a large one, and why isolation, reporting, and tested backups belong on every owner’s checklist.