The first steps
- Stay calm, inform those in charge: who leads the incident? Who decides? This should be settled in advance.
- Disconnect affected systems from the network: unplug the cable or disconnect Wi-Fi to stop the spread. Do not rebuild devices too quickly, as traces would be lost.
- Protect backups: check whether backups are reachable and take them off the network before they are affected too.
- Preserve evidence: photograph the ransom note, note the time, document affected systems.
- Change credentials: if possible from a clean device: administrator accounts and key services.
Whom to inform
- Your IT service provider and, if you have one, your cyber insurer. Many policies require prompt notification.
- The police: the central cybercrime contact point (ZAC) of the state criminal police office takes reports.
- If personal data was lost or accessed: the data protection authority, generally within 72 hours of becoming aware (Art. 33 GDPR), and affected individuals where required.
- If your company falls under NIS2: observe the reporting deadlines set out there.
Pay the ransom?
Authorities generally advise against it. Payment guarantees neither decryption nor that data will not be published, and it funds further attacks. The decision does not belong in the rush of the first hour but should be discussed with specialists and, where appropriate, legal counsel.
Recovery and lessons
Restore systems from clean backups once the entry point and spread are understood. Otherwise the attack repeats. Afterwards, credentials, permissions and network rules need review. Write down what went well and what did not, and adapt the emergency plan.
What to prepare in advance
An emergency plan with phone numbers, roles and a first-hour guide, printed, because digital documents may be unreachable during an attack. Add tested backups (see the 3-2-1 rule) and a contact you can call. This article is not legal advice.