What to do in the first hour after a ransomware attack

In the first 60 minutes after discovering ransomware, a small office should isolate the affected machine without shutting it down, photograph all evidence before taking any other action, and call a managed IT or incident response provider before attempting recovery. Whether the event costs one day or one month of operations depends almost entirely on whether clean, tested backups exist and whether a response plan was in place before the attack began.

The ransom note is on the screen. Your stomach drops. Every instinct says do something — restart the computer, call your nephew who's good with tech, maybe just pay and get it over with. All three responses can make the situation significantly worse.

Here is what to do instead, minute by minute.

Minutes 0–5: Stop. Look. Do not touch.

Ransomware encrypts files while it spreads. Every second the infected machine stays connected to your network, the attack surface grows. Before you pull any plugs, take out your phone and photograph the ransom note on screen. That image is evidence. Note the exact time, the machine involved, and what you were doing when the note appeared.

Do not click "pay now." Do not click anything on the infected machine.

Minutes 5–15: Isolate the infected machine — not the whole office

Disconnect the affected computer from your network immediately:

• If wired: unplug the ethernet cable from the back of the machine.
• If wireless: disable Wi-Fi on that machine only, or physically remove it from the room.
• If a network-attached storage device or shared file server shows encrypted folders, disconnect it the same way.

Do not shut the machine down. Ransomware variants increasingly delete themselves after encrypting files. A powered-on machine may still hold forensic artifacts — active processes, memory contents — that an incident response professional can use. Shutting it down destroys that evidence and can complicate recovery.

Leave the router and internet connection running for every other machine in the office. Your team needs access to Microsoft 365 and cloud systems for the next steps.

Minutes 15–25: Check your Microsoft 365 environment — from a clean device

Open a browser on an unaffected machine and sign in to the Microsoft 365 admin center at admin.microsoft.com. You are looking for two things:

• Microsoft Defender for Business alerts. M365 Business Premium includes Defender for Business. Check the security dashboard for active threat detections and which endpoints, if any, are flagged beyond the machine you already isolated.
• OneDrive Files Restore. OneDrive for Business includes a Files Restore feature that lets a user roll back their OneDrive to any point within the past 30 days. If the encrypted files lived in OneDrive, a restore point may already exist. Confirm the option is available. Do not restore yet.

Do not sign in to Microsoft 365 from the infected machine under any circumstances.

Minutes 25–40: Locate your backups — and leave them alone for now

Your recovery outcome hinges on one question: where are your backups, and when were they last tested? Work through this list on paper:

1. OneDrive version history. Files stored in OneDrive retain version history. Check whether affected files show prior clean versions in the file's version history panel.
2. Dedicated cloud or managed backup. If your office uses a separate backup service, identify the most recent restore point and the date of the last successful test restore.
3. External drives. Drives that were physically disconnected at the time of the attack are likely clean. Leave them unplugged until an IT professional confirms the environment is clear.

Write down every restore point you find. Do not start restoring files. Ransomware can persist inside backed-up data, and restoring to an unclean environment reinfects everything you just recovered.

Minutes 40–55: Preserve everything else

While you wait for professional help, document the incident in writing:

• Which machines were affected and which were not
• What files or folders appear encrypted — look for unfamiliar file extensions appended to filenames
• Any unusual emails, links, or attachments anyone in the office opened in the previous 24 to 72 hours
• Names of employees who used the affected machine recently

This written timeline matters to your IT provider, your insurer, and — depending on the data involved — potentially to regulators. Create it now, while the sequence of events is clear.

Minutes 55–60: Make the calls, in this order

Now you call for help. Sequence matters.

1. Your managed IT or incident response provider. They contain the damage, assess scope, and direct recovery. This is the first call. If you do not have a provider on retainer, that gap is exactly what ransomware operators count on.
2. Your cyber insurance carrier. Most policies require prompt notification. Many carriers have a pre-vetted incident response firm they will dispatch — and cover. Have your policy number ready before you dial.
3. Legal counsel. If your office handles protected health information, financial records, or confidential client data, your attorney determines your notification obligations under HIPAA, applicable state breach laws, or other regulations. Engaging counsel early also helps preserve attorney-client privilege over the investigation itself.
4. FBI Internet Crime Complaint Center at ic3.gov. Reporting is not mandatory for most small businesses, but it is recommended. The FBI does not charge for the report, and the information aids federal tracking of ransomware groups.

What this hour actually determines

The difference between a ransomware event that costs a small office one day and one that costs a month — or its client relationships — almost always comes down to two things that were true before the attack began: clean, tested backups and a managed response plan.

Microsoft 365 Business Premium gives a small office meaningful tools: Defender for Business for endpoint detection, OneDrive Files Restore for a 30-day rollback window, and device management through Intune. Those tools reduce exposure. They do not replace a dedicated team that knows your environment and can respond in minutes, not hours.

An incident response retainer costs a fraction of what a week of downtime costs. If your office does not have one, the first 60 minutes of a ransomware attack is a costly way to find out.