The First Hour of a Ransomware Incident: An SME Checklist

The first hour of a suspected ransomware incident should focus on limiting further damage, preserving evidence and putting one person in charge of coordination. Do not begin by deleting files, reinstalling devices or searching for random decryption software.

This checklist is general incident guidance. The exact response depends on the affected systems, business impact, available evidence and legal or regulatory obligations.

1. Confirm what people are seeing

Record the time the issue was first noticed and the systems, users or locations involved. Take a clear photo or secure copy of any ransom note, unusual file extension, error message or attacker contact information.

Do not open more encrypted files simply to test them. Do not contact the attacker from a normal business account before the response team has assessed the situation.

2. Isolate affected systems when it is safe

Disconnect affected devices from wired and wireless networks if this can be done safely. The goal is to reduce further communication and spread without destroying evidence.

Do not wipe, reimage or repurpose affected devices. Avoid powering systems off unless the response lead decides it is necessary for safety or containment, because volatile evidence may be lost.

If critical operational or safety systems are involved, follow the organisation's emergency and continuity procedures instead of improvising.

3. Activate a small response team

Name one incident coordinator and create a secure communication channel that does not depend on affected systems. Include the people responsible for management decisions, IT or security, operations, communications, legal advice and data protection where relevant.

Keep a simple incident log with times, observations, decisions and actions. This helps technical work, insurance discussions, regulatory assessment and the later review.

4. Protect accounts and unaffected systems

Ask the authorised IT or security team to review privileged accounts, active sessions and unusual sign-ins. Containment may require disabling compromised accounts, changing credentials from a clean device or restricting access between network segments.

Do not make broad account or network changes without coordination. A rushed change can block responders, interrupt evidence collection or affect systems that are still operating normally.

5. Preserve evidence and prepare information

Collect what is readily available without changing affected systems:

• the ransom note and attacker instructions;
• examples of encrypted filenames and extensions;
• a list of affected users, devices and business services;
• the time normal activity was last confirmed;
• security alerts, unusual emails or recent remote-access activity;
• available backup information;
• key vendors and system owners.

Share files only through a secure channel agreed with the response specialist. Do not send confidential documents or passwords through an initial web form or WhatsApp message.

6. Check backups without rushing to restore

Confirm whether backups exist, when they last completed and whether they are separated from the affected environment. Do not connect a clean backup to a system that may still be compromised.

Restoration should begin after the team understands the likely scope, protects the recovery environment and agrees which business services have priority. A backup can be technically complete but still fail the business if dependencies, credentials or recent transactions are missing.

7. Assess reporting and notification duties

Ransomware may involve unauthorised access or data exfiltration as well as encryption. The organisation should involve its data protection officer and legal adviser to assess notification, contractual, insurance and sector-specific obligations.

The Personal Data Protection Commission publishes a guide on managing and notifying data breaches. The Cyber Security Agency of Singapore also provides incident response playbooks and reporting resources. Use the current official guidance for the organisation's circumstances.

8. Decide the recovery route from evidence

The response team may need to compare backup restoration, decryption assessment, file recovery and system rebuilding. Do not assume that paying a ransom will restore files or prevent stolen data from being used.

FreedomX provides a separate one-time ransomware response and decryption assessment service. Urgent intake is available through WhatsApp, but it is not a 24/7 response guarantee. The initial message should include only the business name, a safe contact and a brief description of what was observed.