What to do in the first hour of a ransomware attack

The first hour matters most. Isolate affected machines from the network immediately — pull the cable or disable Wi-Fi.

Don't pay, don't panic, and don't wipe anything yet. Preserve evidence and call your IT provider and insurer.

With tested, immutable backups, recovery is a process — not a ransom negotiation. This is exactly why we test restores every month.