Network and security
Ransomware: what do you do in the first hours?
Short answer
Take infected devices off the network, but do not switch them off. Wipe nothing, do not pay straight away and get help: your IT administrator, your cyber insurer if you have one, and the police for a report. Check that the backups are intact before you restore anything. If personal data was affected, report it to the Autoriteit Persoonsgegevens, the Dutch Data Protection Authority, no later than 72 hours after discovering it. Restore only once it is clear how the attacker got in.
What do you do straight away?
The first reflex is to switch everything off and reinstall. Do not.
- Take infected devices off the network. Pull the cable, switch off wifi. That stops the spread.
- Leave them switched on. Memory holds traces that vanish when you power off, and sometimes the key itself.
- Disconnect the backups. An external disk, the link to the backup storage. What the attacker has not reached yet has to become unreachable.
- Call for help. Your IT administrator and, if you have cyber insurance, the insurer. They often have a fixed team that you must call in before doing anything yourself.
- Record what you see. Photos of the message, the names of the encrypted files, the time. You need that for the police report, the insurer and the investigation.
What do you not do?
| Do not | Why |
|---|---|
| Switch off or reinstall devices | You wipe the traces that show how it happened |
| Talk to the attacker without help | Every reply gives information away |
| Pay under time pressure | The clock in the ransom note is a negotiating tool |
| Restore a backup onto an infected network | It gets encrypted again |
| Keep it quiet | A data breach carries a duty to report, and customers prefer to hear it from you |
Who do you have to tell?
- The police. File a report. It helps the investigation and insurers ask for it.
- The Autoriteit Persoonsgegevens, if personal data was affected and there is a risk for the people involved.
- The people concerned themselves, if the risk for them is high.
- Your insurer, under the terms of the policy.
- Customers and suppliers who are affected or who run a risk through you.
- The regulator for your sector, if you fall under the Dutch Cyberbeveiligingswet (the law that implements NIS2). It has its own deadlines for reporting incidents; see NIS2.
How do you get back to work?
In this order, and no faster.
- Establish how the attacker got in. Without this you put everything back into an environment with the same open door.
- Establish what was affected. Which systems, which accounts, since when.
- Check whether the backups are clean. Attackers are often inside for weeks before they encrypt. Yesterday’s backup may already be infected.
- Rebuild clean. Reinstall systems, restore data from a copy from before the break-in.
- Change all passwords. Including admin accounts and the links between systems.
- Reconnect step by step, with extra monitoring in the first weeks.
The most used system first: usually email and the accounts.
Why does the backup make the difference?
Because it is the only way out that does not run through the attacker. But only a backup that meets three requirements.
- Out of reach. On separate storage, with its own access that is separate from the accounts in your network.
- Immutable. Cannot be deleted or overwritten for a fixed period, not even by an administrator.
- Tested. A backup that nothing has ever been restored from is an assumption.
The NAS in the meter cupboard that hangs on the same network meets none of the three. More on this under backup and recovery and in backups for small businesses.
How do you reduce the chance?
With the dull measures, because that is how attackers get in when they are missing.
- Two-step verification on every account, certainly on everything reachable from outside
- Updates for firewall, VPN and servers as soon as they are out
- No admin rights for daily work
- A network split into parts, so one infected laptop cannot reach everything
- A backup as described above
- A plan on paper: who calls whom, and where the phone numbers are if email is down
How someone should react to a suspicious email is covered in phishing: what if someone clicked. We set up the measures themselves under cybersecurity for small and medium-sized businesses.
We do not do forensic investigation after an attack; there are specialist firms for that, and your insurer usually has a regular one. What we do is make sure you are ready for it and help with the clean rebuild afterwards.