· 1 min read
Ransomware locks your files and demands payment. When it appears, people panic, and some of the things they do next make it worse. This is the order we recommend. Keep it where your team can find it.
In the first hour
- Call your IT provider or us on +254 734 461 317. Do not wait for office hours.
- Disconnect the affected computers from the network: unplug the cable and turn off Wi-Fi. Do not switch them off, because that can destroy evidence.
- Do not delete anything and do not try to clean the machines yourself.
- Write down what you saw, when it started and which accounts were in use. Photograph the screen.
- Tell the people who need to know: managers, and whoever is responsible for customer data.
- Change passwords for important accounts, from a different, clean device.
- Check your backups. Make sure they are not connected to the affected network.
Afterwards
Restore from clean backups, find out how the attacker got in and close that door, and check whether personal data was taken. Where personal data is involved, the Data Protection Act, 2019 sets duties to notify the regulator and the people affected, so check the current requirements and take legal advice.
Good preparation shortens everything above. A tested backup and a written plan are worth more than any tool.
General information. It is not legal or professional advice for your situation.