A ransomware attack on a London small business rarely announces itself with a single alarm. Files become unreadable, a ransom note appears on a shared drive, or staff report that systems are running slowly. The decisions made in the first 24 hours determine how much data is lost, how long operations stay halted and whether the incident must be reported to regulators. This guide sets out the sequence of actions a ransomware response London SME should follow, drawing on public guidance from national cyber security agencies and on the practical demands of managing incidents for small firms.
Table of Contents
- Quick Takeaways
- The first hour: contain and isolate
- Preserve evidence before you rebuild
- Notify the right parties
- Recovery decisions and the ransom payment
- Restore from clean backups
- Close the entry point
- Testing the plan before it is needed
- Frequently Asked Questions
- References
Quick Takeaways
| Key Insight | Explanation |
|---|---|
| Isolate suspected devices within minutes | Disconnect affected machines from the network, including wireless connections and shared drives, before any clean-up begins. |
| Start a written timeline at first detection | Record who noticed what, when, and which systems were affected. This record supports insurer, legal and regulatory discussions. |
| Rank systems by business impact | Agree the restoration order for payroll, client records and finance systems before engineers start rebuilding anything. |
| Treat payment as a last resort | Payment does not guarantee the return of data and may raise legal questions that require specialist advice. |
| Confirm backups were not reachable | Check that backup copies sat outside the infected accounts and network before restoring any data from them. |
| Notify your insurer early | Cyber policies typically set reporting obligations and may restrict which response suppliers can be engaged. |
| Reset every privileged credential | Assume that administrator and service account passwords were captured, and reset all of them, not only the accounts first affected. |
The first hour: contain and isolate
The first hour is about limiting spread. Ransomware can move across shared drives and connected devices, so delay can increase the number of encrypted systems. Staff should disconnect any suspected device from the network and report the incident to a named person without delay.
A written contact sequence should exist before any incident occurs. In practice, the most common delay is not technical: staff do not know who has authority to shut down systems or whom to call outside working hours. Keep a printed copy of this sequence in a secure location that does not depend on the company network.
Pro tip: Store the contact sequence offline, since a locked network can block access to digital copies at the moment they are needed.
Preserve evidence before you rebuild
Rebuilding a device too early can erase the traces needed to understand how the attacker gained access. Export logs from firewalls, Microsoft 365 sign-in records and endpoint security tools before retention periods expire or systems are reimaged.
Capture the ransom note and first indicators
Photograph the ransom note and relevant screens, and save copies of the note and one encrypted file in a separate location. Record file extensions, affected folders and the time of first detection.
Keep affected devices for review
Where possible, retain one or two affected machines unchanged for forensic review, and label them clearly. Wiping every device immediately may ease short-term pressure but leaves the business without an explanation of the entry point.
Notify the right parties
Notification has three audiences: the insurer, legal advisers and, where personal data is affected, the Information Commissioner’s Office. UK data protection law sets a short deadline for reporting notifiable personal data breaches, so this decision should be made early and documented.
Insurer and legal adviser
Cyber insurance policies usually require prompt notice of an incident and may restrict who can instruct response specialists. Read the policy before engaging outside help, because using an unapproved supplier can affect cover.
Staff and customers
Give staff a short, factual message covering what happened, what they must not do, and where to report suspicious activity. Avoid speculation about cause or attacker identity in external communications until the facts are confirmed.
A documented sequence of decisions made in the first day is worth more to a small business than any single technical action taken under pressure.
Recovery decisions and the ransom payment
Recovery decisions made within the first day shape the cost and duration of the incident. The central question is whether data can be restored from a clean source, which is a technical assessment rather than a negotiation.
Paying a ransom does not guarantee the return of data, and some attackers do not supply a working decryption key. Any contact with an attacker should take place only under specialist and legal advice, because payments can raise sanctions and reporting questions.
In practice, leadership teams benefit from agreeing a decision owner in advance. Without one, pressure from clients and staff tends to force unplanned choices during the first night.
Restore from clean backups
Restoration should start from copies that the attacker could not reach. CISA guidance recommends identifying and prioritising critical systems for restoration on a clean network, and confirming the nature of the data held on impacted systems.
| Recovery option | Suitable when | Main risk |
|---|---|---|
| Restore from isolated backups | Backups were offline or protected from change, and restores have been tested | Restore time depends on data volume and on how well the procedure has been rehearsed |
| Decryption tool from a reputable security source | A verified tool exists for the specific ransomware variant | Not every variant has a tool, and running an unverified tool can cause further damage |
| Pay the ransom | Only as a last resort, under legal advice | No guarantee of decryption, and possible legal and reputational consequences |
| Rebuild from scratch | Backups are unusable or missing | Loss of historical data and the highest effort and cost |
Verify each backup set before restoring it. A backup that was encrypted or altered during the attack will reproduce the problem on the restored system.
Close the entry point
Restoring systems without closing the original route of access often leads to a second attack. The NCSC guidance on mitigating malware and ransomware attacks is a suitable reference point for reviewing how the attacker entered and which controls failed.
Reset privileged credentials
Reset passwords for administrator, service and remote access accounts, and enforce multi-factor authentication on email and cloud platforms. Partial resets leave captured credentials usable, so the reset should cover every privileged account.
Patch and review exposed services
Review remote access tools, unpatched systems and any service exposed to the internet. Document each change, as the record will be needed for insurance and regulatory discussions.
Testing the plan before it is needed
A response plan that has never been rehearsed tends to fail at its first decision point. A tabletop exercise involving managers, the IT provider and the insurer can expose missing contacts, unclear authority and gaps in backup coverage within a few hours.
Restore tests should be scheduled rather than assumed. Confirm that a sample of backups can be restored to a clean environment within the recovery time the business expects, and record the result.
Pro tip: Repeat the exercise after any major change to cloud platforms, staff roles or suppliers, because outdated contact lists are a frequent cause of delay.
iTO.London provides outsourced IT department services for London SMEs, including rapid response helpdesk support, proactive monitoring, cloud system management and security. Learn more about our managed IT services.
Frequently Asked Questions
Should we switch off the whole network straight away?
Isolate affected devices and network segments first rather than shutting down everything. A full shutdown can disrupt systems needed for recovery and may remove evidence held in memory.
Should we pay the ransom?
Payment is not guaranteed to return data and can create legal obligations. Take specialist and legal advice before any decision, and treat payment as a last resort.
Do we have to tell the ICO?
If the incident has affected personal data and poses a risk to individuals, UK data protection law may require notification to the Information Commissioner’s Office within a short statutory deadline. Obtain legal advice promptly.
How long does recovery usually take?
Timescales depend on data volume, backup quality and the number of affected systems. Tested backups and an agreed restoration order are the main factors that shorten recovery.
Can a small business manage a ransomware response without an IT partner?
A business can take initial containment steps internally. Restoration, forensic review and reporting usually require skills that most SMEs do not hold in-house, so an outsourced IT team with defined response times closes that gap.
We welcome feedback from London business leaders on which steps proved hardest to follow during a real incident or exercise, and what they would add to this sequence.
We would love your feedback and any insights you would share with others. What perspective would you add?