A ransomware attack can bring a business to a standstill within minutes. Files become inaccessible, systems lock up, and a ransom demand appears on screen. How you respond in the first hour makes the difference between a contained incident and one that takes weeks to recover from.

This guide covers exactly what to do if ransomware hits your business, what not to do, what UK law requires you to report, and how to reduce the risk before an attack happens.

What Does a Ransomware Attack Look Like?

Ransomware is malicious software that encrypts your files and holds them hostage until you pay a fee, usually in cryptocurrency, to receive a decryption key. Most infections arrive through phishing emails, malicious links, or compromised websites. Newer strains can spread across a network automatically once a single device is infected.

Common signs you’re under attack:

  • Files you can open are suddenly renamed with an unfamiliar extension
  • Applications crash or behave unexpectedly
  • A ransom note appears on screen with payment instructions
  • Your IT team reports unusual network activity or a spike in CPU usage
  • Colleagues report they can’t access shared drives or cloud files

If you see any of these signs, act immediately. Every minute of delay gives the ransomware more time to spread.

The First 60 Minutes: What to Do Right Now

1. Isolate affected devices

Disconnect any infected machine from the network immediately. Unplug the ethernet cable, turn off Wi-Fi, and disable Bluetooth. Do not shut the device down — leaving it on preserves evidence that your IT team or a forensics specialist may need. If you can identify which devices are affected, isolate them all. If you’re not sure, isolate the segment of the network where the infection appears to have started.

2. Disable shared drives and cloud sync

If cloud sync is active on an infected device, the ransomware may already be encrypting your cloud-stored files. Pause or disable sync immediately from a clean device. Disconnect shared network drives from affected machines.

3. Alert your IT team or IT provider

Get your IT team or managed IT provider on the phone. If you use Arc or another managed services provider, this is the moment to call the helpdesk. Do not attempt to run your own recovery process unless you have the expertise to do so without risk of reinfection.

4. Take a photograph of the ransom note

Before anything else changes on the infected screen, photograph or screenshot the ransom note. It will contain information about the ransomware strain, payment instructions, and often a deadline. This is evidence, and it will be needed for any insurance claim or law enforcement report.

5. Identify what has been affected

Work with your IT team to establish which systems, servers, and data have been hit. The scope of the infection will determine your recovery path and what you are legally required to report.

Within 24 Hours

Notify senior leadership and your legal team

A ransomware attack is a business incident, not just a technical one. Senior leadership needs to be informed early so they can make decisions on communication, operations, and whether to involve external specialists.

Report to the relevant UK authorities

UK businesses have reporting obligations following a cyberattack:

  • Action Fraud: Report all ransomware attacks to Action Fraud (actionfraud.police.uk). This is the UK’s national fraud and cybercrime reporting centre and the appropriate first point of contact with law enforcement.
  • The NCSC: The National Cyber Security Centre (ncsc.gov.uk) has a dedicated reporting tool for significant cyber incidents. They can also provide guidance and, in serious cases, direct support.
  • The ICO: If the ransomware attack has resulted in a personal data breach — meaning personal data has been accessed, lost, or encrypted — you are required under UK GDPR to report this to the Information Commissioner’s Office within 72 hours of becoming aware of it. Failure to report can result in significant fines. You must also notify affected individuals if there is a high risk to their rights.

Contact your cyber insurance provider

If you have a cyber insurance policy, notify your provider as early as possible. Many policies have specific requirements around response timelines, and your insurer may have preferred incident response partners they can deploy at no additional cost.

Should You Pay the Ransom?

The consistent advice from the NCSC, Action Fraud, and cybersecurity specialists is not to pay. There are three reasons:

  1. Payment does not guarantee you will receive a working decryption key. Attackers have no legal obligation to restore your files, and a significant proportion of businesses that pay do not recover their data.
  2. It identifies you as a business willing to pay. You are likely to be targeted again.
  3. It funds criminal activity and incentivises further attacks on other businesses.

The only realistic alternative to paying is restoring from a clean backup. If you have one, this is almost always the better path.

Restoring Your Systems

Before you restore anything from backup, your IT team must confirm that the malware has been fully removed from every affected device and any network pathways it may have used. Restoring to a still-infected environment means the ransomware will simply re-encrypt your files.

Once the environment is clean:

  1. Verify the integrity of your backups — confirm they are from before the infection and have not themselves been encrypted
  2. Restore to a clean environment, not to the original infected hardware unless it has been wiped and rebuilt
  3. Test restored systems before reconnecting them to the wider network
  4. Reset all passwords and credentials across the organisation, not just on affected systems — attackers may have harvested credentials before triggering the ransomware

What UK Businesses Are Legally Required to Do

To summarise the legal obligations that apply under UK law:

  • ICO notification: If personal data is involved, report to the ICO within 72 hours
  • Individual notification: Notify affected individuals if there is a high risk to them
  • Record-keeping: Under UK GDPR, you must document all data breaches even if you decide not to report them to the ICO — keeping a record of your decision and the reasons for it
  • Sector-specific obligations: If you operate in financial services, healthcare, or another regulated sector, you may have additional reporting requirements to your regulator

How to Prepare Before an Attack Happens

Most businesses that recover well from ransomware do so because they prepared in advance. The businesses that struggle most are the ones relying on ad-hoc decisions made in the middle of an incident.

Backups

The 3-2-1 rule is the starting point: three copies of your data, on two different types of storage, with one copy stored offsite or in an isolated cloud environment that cannot be reached from your main network. Backups need to be tested regularly — an untested backup is not a backup.

Incident response plan

Have a written plan that covers who to call, in what order, and what decisions need to be made by whom. Include your IT provider’s emergency contact, your legal team, your insurance provider, and the relevant reporting contacts (Action Fraud, NCSC, ICO). A plan made in advance gets followed in a crisis. Decisions made on the fly rarely do.

Staff training

The most common route into a business is a phishing email. Regular awareness training, including simulated phishing tests, significantly reduces the likelihood of an employee clicking the link that starts an infection.

Multi-factor authentication

Enable MFA on all email accounts, remote access tools, and any internet-facing systems. It does not prevent every attack, but it removes one of the most commonly exploited entry points.

Endpoint protection

Ensure all devices are running up-to-date endpoint detection and response (EDR) software, not just basic antivirus. Modern ransomware is designed to evade standard antivirus tools.

Frequently Asked Questions

Can ransomware spread to my cloud storage?

Yes. If an infected device has cloud sync active, ransomware can encrypt local files and those changes sync to the cloud before you have a chance to stop it. Disabling sync immediately is one of the most important first steps.

How long does ransomware recovery take?

It depends heavily on the scope of the infection and whether you have clean, tested backups. A business with good backups and a clear incident response plan can often restore within hours. A business without either can take weeks, and some never fully recover.

Do I have to tell my customers?

If the attack results in a personal data breach affecting your customers, and there is a high risk to their rights, you are required under UK GDPR to notify them. Your legal team or a specialist data protection adviser can help you assess the risk level and decide what communication is needed.

What if we don’t have a proper backup?

Check the No More Ransom project (nomoreransom.org), which offers free decryption tools for a number of known ransomware strains. Beyond that, a specialist ransomware recovery firm may be able to help, though this is expensive and not always successful. The honest answer is that without a backup, your options are limited — which is why getting the right backup strategy in place before an attack is so important.

Get Help Preparing for Ransomware

Arc Systems helps UK businesses put the right protections in place before an attack happens — from backup strategy and endpoint security to incident response planning and staff awareness training.

If you would like to review your current cybersecurity setup, get in touch with the team or find out more about Arc’s cybersecurity services.