Ransomware attack: what a company should do in the first hours

Practical steps after a ransomware attack: isolating affected systems, preserving evidence, checking backups and the mandatory notifications in Bulgaria.

OfSec 3 min read

Ransomware is malicious software that encrypts files on computers and servers and brings a company's work to a halt. The attackers demand a ransom for a decryption key and increasingly threaten to publish stolen data as well. The decisions taken in the first hours determine how much data is lost and how long the company stays offline.

How to recognise the attack

The most common signs are:

  • files no longer open and have a new extension, for example .locked or .encrypted;
  • the folders contain a text file with payment instructions;
  • the antivirus software has been switched off or does not start;
  • the server and shared folders become extremely slow.

The first 30 minutes

  1. Isolate the affected devices from the network: unplug the network cable and switch off Wi-Fi. Do not power the devices off unless necessary, because memory may hold information that is useful for the investigation.
  2. Disconnect shared folders, cloud synchronisation and backups so that they are not encrypted as well.
  3. Do not delete the ransom note or the encrypted files. Photograph the screen and write down the time of discovery.
  4. Change the passwords of administrator accounts from a device that is not affected.
  5. Inform management and appoint one person to coordinate the response and communication.

Paying the ransom

Law enforcement agencies in the EU advise against paying. Payment does not guarantee a working key, does not guarantee that stolen data is deleted and funds further attacks. Before any decision, check whether a free decryption tool exists for that ransomware family in the No More Ransom project (nomoreransom.org), run by Europol and its partners.

Backups

Check whether you have backups that were not connected to the affected network during the attack. Do not connect them to infected systems until you know how the attackers got in, or they may be encrypted too. Recovery starts from clean, reinstalled systems.

Mandatory notifications

  • A ransomware attack is usually a personal data breach, even when it is unclear whether data was taken. If personal data is affected, the company must notify the Commission for Personal Data Protection (КЗЛД) within 72 hours of becoming aware of the breach.
  • Organisations covered by the Bulgarian Cybersecurity Act (NIS2) report significant incidents to the sectoral incident response team (СЕРИКС), with an early warning within 24 hours and a notification within 72 hours.
  • The crime is reported to the Chief Directorate for Combating Organised Crime (ГДБОП).

Reducing the risk of another attack

Most attacks start with stolen passwords, a phishing email or an unpatched server exposed to the internet. Multi-factor authentication, regular updates and backups kept off the network remove the most common entry points. A penetration test shows which of them are open in your environment.

IncidentsRansomware