cybersecurity  ·  October 5, 2026  ·  by Brendan Czerwonka

Ransomware Response Plan: What to Do in the First Hour

Hit by ransomware? Here's the first-hour response plan I'd follow for a Florida small business: who to call, what to unplug, and what never to touch first.

Picture this. It’s 7:40 on a Tuesday morning, and your office manager in Lakeland calls you. She can’t open the shared drive. Then she says the words nobody wants to hear: “There’s a note on the screen, and it says our files are encrypted.”

What you do in the next sixty minutes matters more than almost anything else in the whole incident. I’ve watched a bad morning turn into a two-week disaster because someone started rebooting servers. I’ve also watched a ransomware hit get contained to one laptop because the owner made three good decisions fast.

This isn’t a post about how to prevent ransomware. I’ve covered the basics in 5 cybersecurity basics every Florida small business needs, and I’ll link a few more below. This is the “it’s happening right now” playbook. Print it. Tape it inside a cabinet. Hope you never need it.

Minute zero: stop the spread, not the evidence

Ransomware doesn’t just sit on the first computer it lands on. Once it’s inside, it hunts for shared folders, mapped drives, backup locations, and any other machine it can reach. Your first job is to cut those paths.

Here’s what I’d do, in this order:

1. Disconnect the affected computer from the network. Unplug the Ethernet cable and turn off Wi-Fi. If you can’t tell which machine is infected, disconnect anything showing the ransom note or odd file names (files ending in strange extensions are a giveaway).
2. Do not shut the computer down yet, if you can avoid it. This surprises people. Powering off can wipe out the temporary memory that holds clues about how the attacker got in. Isolate first. A professional can decide later whether to power down.
3. Disconnect shared storage and backup drives. If there’s a USB backup drive plugged into a server, pull it. If your NAS is reachable from the infected machine, take it off the network. Backups are what the attackers want to destroy first.
4. Don’t log into anything from the infected machine. Not email, not banking, not Microsoft 365. Assume anything typed on it is being watched.

Notice what’s not on this list: panicking, rebooting, “running a quick antivirus scan,” or deleting the ransom note. That note has the attacker’s contact details and often the name of the ransomware family, which tells a responder exactly what we’re dealing with.

Take a photo, then make the calls

Once the machine is isolated, grab your phone and photograph the screen. Photograph the ransom note, any file extensions, and the date and time. Write down who noticed it first and what they were doing. I’ll ask you for all of it.

Then work down this call list. Don’t skip around, because the order is deliberate.

Your IT provider. If you have a managed IT partner, this call comes first. They know your network, where your backups live, and what’s normal. If you don’t have one, call someone today who does incident response. That’s a good time to ask yourself why you don’t have one, but not in the first hour.

Your cyber insurance carrier. Many policies require you to report quickly, often within 24 to 72 hours, and some require you to use their approved responders. If you spend money on your own recovery team before you call, you can end up fighting over reimbursement. I wrote about what these policies actually require if you want to check yours before you ever need it.

Your attorney. If customer data might be involved, you want counsel in the loop early. This is also where Florida law comes in, which I’ll get to in a minute.

Law enforcement. Report it to the FBI’s Internet Crime Complaint Center (IC3.gov). The Tampa Bay area has an active FBI field office that sees this stuff constantly. Reporting doesn’t mean they’ll recover your files, but it creates a record that insurers, lawyers, and regulators may ask about.

Figure out how bad it is (and what you can trust)

With the spread contained and the right people on the phone, the next question is scope. This is where I earn my keep, and it’s where owners without a plan lose the most time. We need to answer four things:

• Which machines and accounts are affected? One laptop? One department’s shared folder? The whole server?
• Are the backups intact? This is the single biggest factor in how this ends. A clean, recent, offline or immutable backup means you restore and move on. Backups that were mapped to the infected machine are often encrypted too.
• Did the attackers take data before encrypting it? Modern ransomware crews often steal files first and threaten to publish them. That turns a “restore from backup” problem into a “notify your customers” problem.
• How did they get in? Usually it’s a phished password, an unpatched remote-access tool, or a login with no multi-factor authentication. If we don’t close that door, they walk back in next week.

If you want a reason to take backups seriously before any of this happens, my breakdown of cloud vs. local backup and what actually survives ransomware is worth ten minutes.

Should you pay the ransom?

I get asked this in the first hour more than any other question, so let me be direct about how I think about it.

I don’t recommend paying, and I’ll tell you why in plain terms. Paying doesn’t guarantee you get your data back. Some businesses pay and receive a decryption tool that’s slow, buggy, or only partly works. Some pay and get nothing. Paying also marks you as a business that pays, and that tends to bring the next attempt. And depending on who’s behind the attack, paying certain groups can create legal problems of its own, which is another reason your attorney needs to be on that call.

That said, it’s your business and your decision. I’ve seen owners who had no usable backup, with payroll due Friday, face a genuinely terrible choice. If you find yourself there, the decision should be made with your attorney, your insurer, and an incident response professional in the room, not alone at 9 p.m. with a countdown timer on the screen. Ransom negotiators and decryption experts exist for exactly this reason.

The best answer to “should we pay?” is having backups good enough that the question never comes up.

Florida-specific things to know

If you run a business anywhere in Hillsborough, Polk, or Pasco County, you’re covered by Florida’s data breach notification law, the Florida Information Protection Act. In short, if personal information of Florida residents was (or is reasonably believed to have been) accessed, you generally have to notify affected individuals within 30 days, and notify the Florida Attorney General’s office if 500 or more people are affected. I walked through the details in my post on Florida’s data breach law, and that’s one to read with your attorney, since I’m not one.

There’s also a very Florida wrinkle: hurricane season. Ransomware crews love a distracted target. If a storm has your staff working from home, your office offline, and your attention elsewhere, that’s exactly when a phishing email lands. If your plan for a hurricane and your plan for ransomware are both “figure it out when it happens,” they’re the same gap. My hurricane-season disaster recovery checklist covers a lot of the same ground.

Build your one-page ransomware plan before you need it

Everything above works better if you’ve written it down in advance. Here’s the short version I help clients put together, and you can start it today:

• A contact sheet with your IT provider, insurance carrier and policy number, attorney, and key staff, stored somewhere not on your network (a printed copy and your phone both work).
• A map of where your data lives. Servers, cloud accounts, laptops, the NAS in the back closet, the QuickBooks file someone saved to their desktop.
• Backups that are tested and separated. At least one copy that can’t be reached from a regular workstation, and a restore you’ve actually tried, not just a green checkmark in a dashboard.
• Multi-factor authentication on email and remote access. It’s the cheapest protection against the most common way in.
• A decision-maker. One person who has authority to say “unplug it” at 7:40 a.m. without waiting for a committee.

A plan like this is much of what a good managed IT partnership covers, together with the security layers that make an attack less likely in the first place: endpoint protection that watches for this behavior, patching, monitored backups, and staff training.

If it’s happening right now

If you’re reading this because something just went wrong, stop reading and start with minute zero: unplug the machine, photograph the screen, and call your IT provider and insurer.

If you don’t have anyone to call, reach out to me and tell me what you’re seeing. And if you’re reading this on a calm day, that’s the better time to talk. A free consultation will tell you where your backups stand, whether your insurance expectations match reality, and what a one-page response plan should look like for your office. Ransomware is a bad day for any business, but with a plan it doesn’t have to become the end of one.

Tags: #ransomware#incident response#cybersecurity#small business#florida#backup