Restoring after ransomware, step by step

Step 1: Contain the damage

The moment ransomware is suspected, stop it spreading. Disconnect affected computers from the network by unplugging network cables and turning off wi-fi, but do not switch them off unless advised, because memory can hold useful evidence. If you cannot tell which machines are affected, disconnecting the office internet connection buys time. Ask staff to stop working on shared drives and not to delete anything.

Do not reach for the backups immediately. If the attacker is still in your network, restoring now simply gives them fresh files to encrypt, and connecting your backup system to an infected network may expose it as well. Containment comes first. Keep the backup console, appliance and any offline drives disconnected until you know how the attacker got in and have confirmed they no longer have access.

Step 2: Make the right calls

Contact your IT provider or whoever manages your systems. Call your cyber insurer early, often before taking major action, because many policies require you to use their nominated incident responders and may not cover costs you commit to without approval. You can also report the incident to the National Cyber Security Centre (which now includes CERT NZ) for guidance.

If personal information may have been accessed or made unavailable, think about the Privacy Act 2020. A breach likely to cause serious harm must be notified to the Privacy Commissioner and affected individuals as soon as practicable. Many ransomware groups now steal data before encrypting it, so assume data may have been taken until you know otherwise.

Step 3: Understand what happened

Before restoring, work out how the attacker got in and when. Was it a phished password, an exposed remote desktop, an unpatched firewall or a compromised supplier account? Investigators look for the first sign of access, which is often days or weeks before the encryption. That date matters, because any backup taken after it may contain the attacker's tools or a backdoor.

Collect logs and keep copies of ransom notes and affected files. Avoid contacting the attackers yourself. Whether to engage with them, if at all, is a decision to take with your insurer and specialist responders, and authorities generally advise against paying. Write a simple timeline as things happen, noting who did what and when, because insurers, responders and possibly the Privacy Commissioner will all ask for it.

Step 4: Find a clean restore point

With the timeline in hand, check the backups. Confirm they were not encrypted or deleted, which is where immutable and offline copies prove their value. Pick a restore point from before the attacker first got in, not just before the encryption started. Restore it first to an isolated environment and scan it, checking that files open and that no unknown programs, scheduled tasks or user accounts have come along with it.

You may need to combine sources: an older clean server image plus more recent data files that have been scanned and checked. This is careful work, and rushing it is how businesses get reinfected days after recovering. Expect some recent work to be lost if the only clean copy is older, and plan how to recreate it from emails, paper and client copies.

Step 5: Rebuild and restore in order

Affected computers should be wiped and rebuilt, or replaced, rather than cleaned. Servers are usually rebuilt from known-good images or fresh installs, with data restored on top. Before reconnecting anything, fix the way in: patch the vulnerable system, close exposed remote access, and reset every password, starting with administrator and service accounts. Enforce multi-factor authentication everywhere it is not already on.

Restore in the priority order from your disaster recovery plan, usually communications first, then the systems the business earns from, then everything else. Bring systems back gradually and monitor them closely for any sign the attacker is still present. Keep staff informed with short, regular updates, so they know what they can use and what to avoid.

Step 6: Learn and strengthen

Once operating again, hold a review. How did they get in? How long were they inside before anyone noticed? Did the backups survive, and how long did restoring take? Which steps of the plan worked, and which were missing? Use the answers to improve security and the plan itself. Involve the insurer and responders in the review if they were part of the response, since they often see patterns a small business would not.

Common improvements after ransomware include adding an immutable backup copy, separating backup credentials, rolling out multi-factor sign-in everywhere, improving patching, adding endpoint detection, and training staff to spot phishing. Each one makes a repeat less likely and recovery faster if it does happen. Schedule the improvements with dates and owners, because the urgency fades quickly once everyone is back at work.