Ransomware response
Hit by ransomware?
Call our 24/7 incident line.
If files are encrypted, systems will not start or a ransom note has appeared, call 1-650-300-7557. ACS Cyber helps organizations hit by ransomware contain the attack, find out how it happened and what was taken, work with their insurer and counsel, and recover from clean sources.
01
Call for help first
Call our 24/7 incident line before you restore, wipe or rebuild anything. Early guidance protects both your recovery options and the evidence. If you have cyber insurance, call its claims line or breach hotline early too: many policies require prompt notice or approved responders.
02
Isolate, do not power off
Disconnect affected devices from the network by unplugging cables or turning off Wi-Fi. Leave them powered on unless we advise otherwise, because memory can hold useful evidence.
03
Protect your backups
Disconnect backup systems and storage from the network if they are still reachable. Do not run restores until the threat is contained.
04
Keep the ransom note
Photograph the ransom note and leave it in place. Do not contact the attackers or open any links in it.
05
Notify your insurer and counsel
Check your policy’s notice requirements and call your carrier’s claims line. Bring in legal counsel early.
- Encrypted or renamed files
- A ransom note on screens or in folders
- Servers or systems that will not start
- Disabled security tools or deleted backups
Not a client yet? You can still call. Our incident line is answered 24/7 for organizations nationwide.
First steps
Do this now, and what to avoid
These steps apply to most ransomware incidents. If our team, your insurer or your counsel advises differently, follow their direction.
| Do this now | Avoid this |
|---|---|
| Isolate affected devices from the network | Powering off, wiping or reimaging devices before evidence is collected |
| Disconnect backups and check whether offline copies are intact | Restoring from backups before the attackers’ access is removed |
| Preserve the ransom note, logs and suspicious files | Deleting files, logs or accounts to clean up |
| Leave the payment question to leadership, with counsel, insurer and law-enforcement input | Contacting, negotiating with or paying the attackers on your own |
| Coordinate by phone or from devices you know are clean | Discussing the incident over email or chat the attackers may be watching |
| Report the attack to the FBI (IC3) or CISA, with counsel’s input | Making public statements before the facts are known |
Containment and forensics
How we contain and investigate ransomware
Ransomware is usually the last step of an intrusion, not the first. Attackers often spend time inside a network, collecting credentials and copying data, before they encrypt anything. Our response addresses the whole intrusion, not just the encrypted files.
We help you contain the spread by isolating affected systems, disabling compromised accounts and cutting off access paths such as remote-access tools and VPN accounts. Our in-house forensic team then works through endpoint, server, firewall, identity and backup records to reconstruct what happened, with documented chain of custody. See how an incident investigation works.
- How the attackers got in: phishing, exposed remote access, a vulnerable system or stolen credentials
- Which accounts, systems and backups they reached
- Whether data was copied out before encryption
- Anything they left behind to get back in, such as new accounts or tools
- A timeline from first access to encryption
Why data theft matters
Many ransomware groups copy data before encrypting it and threaten to publish it. Even if you can restore everything, stolen data can create notification obligations.
Our investigation looks for evidence of whether data left your network, and which data, so your counsel can assess what it means.
Coordination
Working with your insurer, counsel and law enforcement
Call your cyber insurer early. Many policies set notice requirements, and some require approved response firms or the carrier’s consent before costs are incurred. We work alongside insurer-assigned response firms where your policy permits, and we coordinate with your insurer and counsel when you authorize it.
Whether to pay a ransom is a decision for your leadership, made with your counsel, your insurer and input from law enforcement. Payment raises legal questions, including sanctions considerations, and paying does not assure working decryption or the deletion of stolen data.
If patient, customer or financial records may have been accessed, your counsel will weigh obligations under HIPAA, state breach-notification laws and your contracts. We give counsel the forensic facts. We do not provide legal advice.
What we provide to each party
- Insurer: incident documentation and a record of actions taken
- Counsel: findings, timelines and affected-data analysis
- Law enforcement: preserved evidence, if you choose to report
- Leadership: plain-language updates for decisions
Recovery
Recover from clean sources, in a controlled order
Restoring too early can bring the attackers back. We help you confirm that backups are intact and free of the attackers’ tools, decide what to restore first based on what the business needs, and check each system before it returns to use. For the full path from recovery to ongoing protection, see post-incident recovery and protection.
Where systems cannot be trusted, they are rebuilt. Atlantic Computer Systems, our parent company, provides managed IT, so clean rebuilds of servers, endpoints, Microsoft 365 and networks can be carried out by the same organization. Learn about Atlantic Computer Systems.
- Recovery priorities agreed with leadership
- Backups checked before anything is restored
- Credentials reset and attacker access removed
- Monitoring in place as systems come back
Prevention
Reduce the chance of another ransomware attack
These controls address the routes ransomware commonly uses and make recovery more dependable if something gets through.
24/7 managed detection and response
Our in-house SOC analysts watch for the early signs of an intrusion and take pre-approved containment actions, such as isolating a device, under rules agreed with you.
ACS-managed EDR
ACS supplies and manages the endpoint detection and response agent on your devices, and our SOC monitors what it sees.
Immutable and offline backups
Backups that attackers cannot alter or delete, with restores tested on a schedule so you know they work when you need them. Atlantic Computer Systems, our parent company, provides managed cloud and backup services.
MFA everywhere
Multi-factor authentication on email, remote access and admin accounts, with phishing-resistant methods for privileged roles.
Patching and vulnerability management
Regular scanning and prioritized patching of internet-facing systems, plus in-house penetration testing.
Security awareness training
Phishing is a common way in. Training and simulations help your people spot it and report it.
FAQ
Ransomware questions
Isolate affected devices from the network without powering them off, protect your backups, keep the ransom note and call an incident response team. Then notify your cyber insurer, involve legal counsel and consider reporting to the FBI’s IC3 or CISA. ACS Cyber’s 24/7 incident line is 1-650-300-7557.
That decision belongs to your leadership, made with legal counsel, your insurer and input from law enforcement. Payment raises legal questions, including sanctions considerations, and it does not assure that files can be decrypted or that stolen data will be deleted. We help you understand your recovery options so the decision is an informed one.
Usually not. Disconnect them from the network instead, by unplugging the cable or turning off Wi-Fi. Powering off can destroy evidence held in memory. If encryption is actively spreading and you cannot isolate a device, call us and we will advise.
We cannot promise decryption. For some ransomware strains, decryption tools exist, and we check for them. Otherwise, recovery depends on clean backups or rebuilt systems, which we help you plan and carry out.
It can be. Many ransomware groups copy data before encrypting it, and encryption of regulated data can raise questions under laws such as HIPAA. Our investigation looks for evidence of whether data was accessed or taken, and your counsel advises on what that means for notification. See data breach response. For healthcare organizations, Atlantic Computer Systems, our parent company, also offers healthcare ransomware protection.
Reporting is encouraged, and your counsel can tell you whether any reporting is legally required for your organization. You can report to the FBI Internet Crime Complaint Center (IC3) or to CISA. We can provide the technical details a report needs.
24/7 incident line
Dealing with ransomware right now?
Call 1-650-300-7557 and speak with our incident team. If the attack is over and you want to plan what comes next, book a free 30-minute consultation. For other incidents, see how we help after any compromise.