In short
Contain the problem by disconnecting affected devices, don't switch everything off or pay a ransom, call your IT or security provider, preserve evidence, and follow your incident plan. Speed matters, but so does staying calm.
1. Contain it
Disconnect affected computers from the network by unplugging the network cable or turning off Wi-Fi. Don't shut them down straight away if you can avoid it, because useful evidence can be lost. If an account is compromised, reset its password and sign it out of all sessions.
2. Get expert help
Call your IT support or security provider immediately. If you don't have one, get incident response help. Every minute an attacker has inside your network lets them reach more systems.
3. Don't pay, and don't wipe
Don't pay a ransom without professional advice. Paying doesn't guarantee your data back. Don't start wiping or rebuilding machines until the attack is understood; you may destroy evidence and reinfect clean systems.
4. Preserve evidence
Take photos of ransom notes and error messages. Note the time things were noticed and what was done. Keep suspicious emails. This helps investigators, insurers and any report you need to make.
5. Communicate
Tell staff what's happening and what not to do. Check your cyber insurance policy, as many insurers need to be told quickly. If personal data may be affected, you may need to report it to the Information Commissioner's Office within 72 hours. Police Scotland can be contacted by calling 101.
6. Recover and learn
Once the attack is contained, restore from clean, tested backups and fix how the attacker got in. Then review what happened and update your plan.
Prepare before it happens
The businesses that recover fastest have tested backups, 24/7 monitoring and a written incident plan. Nexa SecureIT offers urgent incident response, SOC-as-a-Service and backup and disaster recovery for businesses across Glasgow and the Central Belt. If you're under attack now, call 01355 201 093.