What Happens If Ransomware Hits a Small Office: The First Hour, Day, and Week

Picture an ordinary Tuesday morning. Your front desk can’t open the scheduling system. A shared folder is full of files with strange names, and there’s a note on the screen saying your data has been locked and asking for payment.

It’s a bad morning, but it doesn’t have to be the end of the story. How the next few days go depends mostly on decisions made long before that Tuesday. Here’s a plain-English walk through what happens, and what separates offices that get back to work quickly from those that struggle.

(This is general information, not legal advice. Every incident is different.)

The first hour: stop the spread, don’t erase the evidence

The first hour is about containing the problem, not fixing it.

• Disconnect affected computers from the network. Unplug the network cable or turn off Wi-Fi on any machine that looks affected. CISA, the federal government’s cyber defense agency, says to “determine which systems were impacted, and immediately isolate them” (CISA #StopRansomware Guide).
• Don’t wipe, reset, or reinstall anything yourself. It’s tempting to “just start over,” but that can destroy the information needed to understand what happened. CISA suggests powering devices down only if you can’t disconnect them, because powering off erases evidence held in memory (CISA).
• Call your IT provider right away. If you’re a BizTechPro client, call client support at (845) 634-2100. We’ll help contain the problem by isolating devices and securing compromised accounts, check whether data or email was accessed, and guide your next steps.

The first day: figure out what happened and who needs to know

Once things are contained, the questions get bigger.

How far did it spread? Your IT team works out which computers and accounts were affected, and whether information may have been copied out, not just locked.

Report it. CISA says every ransomware incident should be reported to the U.S. government, and that you only need to report once to the FBI, CISA, or the U.S. Secret Service for all the agencies to be notified (CISA: Report Ransomware). The FBI’s reporting site is ic3.gov, or you can contact your local FBI field office (FBI/IC3).

Call your cyber-insurance carrier and your attorney. CISA lists your cyber insurance company among the people to keep informed (CISA). Many policies have their own steps, so check before making big decisions.

What about paying? That’s a serious decision for you, your attorney, and your insurer, not for us. For what it’s worth, the FBI says plainly that it “does not support paying a ransom.” It notes that paying “does not guarantee the victim will regain access to their data,” and that some victims never received decryption keys or were asked for more money after paying (FBI/IC3). This is where good backups change everything: if you can restore clean data, you aren’t stuck negotiating with criminals.

The first week: restore carefully and handle notifications

Restore from clean backups, most important systems first. CISA recommends restoring “from offline, encrypted backups based on a prioritization of critical services” and taking care “not to re-infect clean systems during recovery” (CISA). The systems you can’t run without come back first, each checked before it rejoins the network.

Reset passwords and lock down accounts. Passwords that may have been exposed get changed, and multi-factor sign-in gets turned on anywhere it was missing.

Work through notification requirements with your attorney. If personal information may have been accessed, the law may require you to tell people. Two examples for our area:

• New York: Under General Business Law § 899-aa, part of the NY SHIELD Act, businesses must notify affected New York residents “in the most expedient time possible and without unreasonable delay,” and within 30 days after discovering the breach, with limited exceptions for law enforcement needs. The Attorney General, Department of State, and State Police must be notified too (NY GBL § 899-aa).
• Medical practices (HIPAA): An unauthorized use or disclosure of patient information is presumed to be a breach unless a risk assessment shows a low probability that it was compromised. Patient notices must go out “without unreasonable delay and in no case later than 60 days following the discovery of a breach” (HHS Breach Notification Rule).

New Jersey has its own breach notification law as well, so New Jersey offices should go over it with their attorney.

What separates offices that recover quickly

Offices that bounce back usually have a few things in place before anything goes wrong:

1. Tested backups. Not just backups that exist, but backups that have actually been restored in a test, so everyone knows they work and how long recovery takes.
2. Copies attackers can’t reach. Ransomware often goes after backups first. Both the FBI and CISA advise keeping backups that aren’t connected to the systems they protect (FBI/IC3, CISA). At BizTechPro, we keep immutable copies that can’t be encrypted, altered, or deleted for a set period, stored away from your network.
3. Multi-factor sign-in everywhere. A stolen password alone shouldn’t be enough to get in. CISA recommends phishing-resistant MFA, especially for email, remote access, and critical systems (CISA).
4. A written response plan. It says who does what, which systems come back first, and how staff keep working in the meantime.
5. Knowing who to call. One phone number, answered by people who already know your setup, saves precious time in that first hour.

A short ransomware readiness checklist

• When were your backups last test-restored, and how long did it take?
• Is at least one backup copy off-site and protected from being changed or deleted?
• Are your Microsoft 365 email and files backed up separately?
• Does every account, especially email and remote access, require multi-factor sign-in?
• Do you have a written plan that says which systems come back first?
• Does everyone know who to call, and who should not start wiping computers?
• Do you have your cyber-insurance carrier’s claim number and your attorney’s contact handy?
• Have staff had recent training on spotting phishing emails?

If you couldn’t check most of these boxes, you’re not alone, and it’s very fixable. Our backup & disaster recovery and cybersecurity pages explain how we set this up.

Frequently asked questions

Should I turn off the infected computer?

Disconnect it from the network first by unplugging the cable or turning off Wi-Fi. CISA advises powering devices down only if you can’t disconnect them, because that wipes evidence held in memory. Then call your IT provider before doing anything else.

Who should I report a ransomware attack to?

CISA says every ransomware incident should be reported to the U.S. government, and one report to the FBI (through ic3.gov or a local field office), CISA, or the U.S. Secret Service is enough. Also call your cyber-insurance carrier and your attorney.

Should we pay the ransom?

That’s a decision for you, your attorney, and your insurer. The FBI says it does not support paying a ransom and that paying doesn’t guarantee you’ll get your data back. Tested, protected backups are what give you a real alternative.

Do we have to tell our customers or patients?

Possibly. If personal information was accessed, laws such as New York’s General Business Law § 899-aa and the HIPAA Breach Notification Rule set deadlines for notifying people. Work through it with your attorney as early as possible.

Let’s make sure your Tuesday never looks like this

BizTechPro has helped small businesses with IT and security from Pearl River, NY, since 2008. We serve offices in Rockland and Westchester counties in New York, and Bergen, Passaic, Morris, and Essex counties in New Jersey. If you’d like a plain-English look at how ready your office is, call (845) 747-5803 or schedule a conversation.