Ransomware: what to do in the first hour
The decisions taken in the first sixty minutes largely determine how long the shutdown lasts. Here is the order of actions, and the three mistakes to avoid.
Isolate without switching off: disconnect the affected machines from the network, cut the Wi-Fi and the links between sites, but do not switch anything off, because the RAM holds information useful for the analysis. Then cut access to the backups so they are not encrypted in turn. Alert management, file a police complaint, and do not pay. Nothing guarantees that the data will be returned.
Ransomware is among the threats most frequently reported by companies to Cybermalveillance.gouv.fr (the French government's cyber assistance service). When it strikes, the gap between a company that is back up and running in three days and one that takes three weeks is largely decided in the first hour.
1. Isolate, without switching off
- Unplug the network cable from the affected machines, or disable their network card.
- Cut the company Wi-Fi and the links between sites: this is how the attack spreads.
- Suspend remote access and VPNs while you work out how far it has gone.
- Do not switch the machines off. Shutting down and restarting erase information held only in memory, which is often decisive for the analysis.
2. Protect the backups immediately
Modern attacks look for backups before encrypting production data. A backup that can be reached from the network at the time of the incident is highly likely to be encrypted as well.
- Physically disconnect any backup media that are still plugged in.
- Stop automatic synchronisation to the cloud: it would copy the encrypted files over the good ones.
- Do not test a restore on the contaminated network, or you will lose the clean copy.
3. Alert and report
- Inform management: the decision to halt operations does not belong to the person who discovers the incident.
- File a police complaint. It is necessary for insurance, and it places you within the legal process.
- If personal data is involved, notification to the CNIL (the French data protection authority) is subject to a short deadline: raise the matter in the first hour, do not discover it on day three.
- Warn partners whose access could have been compromised.
The three most costly mistakes
| Reflex | Why it is a problem |
|---|---|
| Switching everything off | Erases traces in memory and complicates the analysis, without stopping the encryption already carried out |
| Paying the ransom | No guarantee the data will be returned, funds criminal activity, and marks the company as a target that pays |
| Bringing systems back online too quickly | If the entry point has not been identified, the attack starts again on the restored infrastructure |
What is prepared before, not during
A company that recovers quickly was not lucky: it had prepared three things.
- An offline or immutable backup that the encryption cannot reach.
- A restore that has already been tested, with a measured duration: you know how long it takes because you have timed it.
- An up-to-date list of contacts, printed. On the day of the incident, the internal directory is often inaccessible.
Frequently asked questions
- Should computers hit by ransomware be switched off?
- No. They should be isolated from the network by unplugging the cable or disabling the network card, but left switched on. Shutting down erases information held only in RAM, which is often needed to identify the entry point and the extent of the compromise.
- Should you pay the ransom?
- The authorities advise against it. Payment offers no guarantee of recovering the data, does not guarantee that exfiltrated copies are deleted, funds criminal activity and flags the company as a target willing to pay.
- How long does it take to recover?
- It depends almost entirely on the state of the backups and on whether a restore has already been tested. For a company with an offline copy and a proven procedure, recovery is counted in days. Without them, it is counted in weeks.
Next step
Sources
Published 29 August 2026 · Équipe Skill Group, Cybersécurité
Going further
Microsoft 365: the security settings to check in your company
Microsoft 365 is secure by design, not by default. Here are the settings that matter, and the backup question that many companies discover too late.
When the internet goes down, who is actually responsible?
Three providers, three diagnoses, and a company at a standstill while they argue. This is not bad faith: it is a predictable consequence of splitting the work.
Ambulances and approved medical taxis: stop losing jobs over the phone
In medical transport, a missed call is a lost job, and often a client who will call a competitor next time. Here is what can actually be fixed.