What to Do in the First Hour of a Ransomware Attack in Valley Springs, California

Disconnect the affected machines from the network, lock down your backups, and call your IT or incident response team from a phone or account the attacker can’t read.

The FBI’s Internet Crime Complaint Center (IC3) recorded 3,156 ransomware complaints in 2024, with adjusted monetary losses exceeding $12.5 million, according to the FTC’s 2025 ransomware report. That covers reported complaints only, not every attack.

For Valley Springs businesses, any ransomware attack response begins with stopping the spread.

How Do You Contain a Ransomware Attack Without Worsening It?

Ransomware spreads through shared drives, remote sessions, and trusted accounts. Early in a ransomware attack response, unplug the network cable, disable Wi-Fi, or use your endpoint tool’s isolation feature.

Isolating a device is not the same as powering it off. Shutting down can wipe volatile evidence such as running processes and active network connections.

If you can disconnect a machine, usually leave it running. If that’s impossible, powering down can still be right. It depends on the situation.

How Do You Protect Backups During a Ransomware Attack?

Backups decide whether you still have a way back. Pause restores, cleanup jobs, and retention changes, then lock down any backup console, repository, or cloud storage reachable from the compromised network.

Then establish:

• Whether attackers could reach the backup environment
• Whether backup credentials were compromised
• Whether backups were encrypted or deleted
• Whether the recovery point predates the compromise
• Whether backups are isolated from production
• Whether restoration has been tested

A backup file proves little on its own. One taken after the attacker arrived can quietly reintroduce the problem.

What Evidence Should You Preserve During a Ransomware Attack?

The ransom note only shows what the attacker wants you to see. Logs, timestamps, malware artifacts, memory captures, and firewall records show how long they were inside and whether persistence remains.

Wiping or reimaging straight away feels productive but destroys that evidence. Photograph the note, record when symptoms first appeared, and log every action and who took it.

Qualified responders can then establish:

• How the attacker got in
• Which accounts were compromised
• Which systems were accessed
• Whether data was exfiltrated
• Whether persistence is still present

Which Accounts and Access Points Should You Secure First?

Valid credentials let an attacker walk back in after systems are restored. Start with:

• Privileged administrator accounts
• Cloud identities such as Microsoft 365
• VPN and remote-access accounts
• Service accounts
• Active sessions
• Unexpected MFA changes

Coordinate resets with the investigators and run them from known-clean systems, without delaying urgent containment. Poorly timed changes can muddy the evidence and interfere with legitimate access.

Treat any credential on or reachable from a compromised system as exposed throughout your ransomware attack response.

Who Should You Contact During a Ransomware Attack?

Your ransomware incident response steps should bring in these parties early.

Notification duties vary by industry, contracts, and state and federal regulation, so California counsel should confirm what applies to you. CISA and the FBI encourage victims to report ransomware, and IC3 accepts reports, but a recommendation to report is not a legal mandate.

If email or collaboration tools may be compromised, the attacker could be reading your plans. Use phones or a fresh messaging account created outside the affected environment.

Payment does not guarantee recovery. The decision belongs with leadership, counsel, security professionals, your insurer, and possibly law enforcement. OFAC sanctions rules can complicate it.

When Is It Safe to Begin Ransomware Attack Recovery?

Not until the attacker is out and you know what they touched. Real incidents vary, but recovery usually runs in this order:

• Contain the spread and investigate how far it went
• Remove the attacker’s access and reset compromised credentials
• Rebuild a clean environment and check that backups predate the compromise
• Restore critical systems first, in dependency order, and test them before use
• Fix the weakness that let the attacker in

Ransomware attack recovery should not start because the business wants its files back. The team needs reasonable confidence that the attacker is gone and the backups are safe to restore.

Restore by business priority and dependency. An application is no use if the authentication service or database it relies on is still compromised.

Written ransomware incident response steps, agreed upon before an attack, make these calls easier when everyone is under pressure.

What Should You Avoid Doing in the First Hour?

• Blindly shutting down every system
• Wiping or reimaging machines before evidence is preserved
• Treating the ransom note as the whole story
• Assuming backups are clean
• Restoring everything immediately
• Using potentially compromised accounts
• Discussing response decisions on possibly compromised systems
• Rushing a ransom-payment decision

How Can You Prepare for a Ransomware Attack Before It Happens?

Almost none of the decisions above go well when made for the first time under pressure. A strong ransomware attack response needs a tested incident-response process, isolated backups, clear responsibilities, secure remote access, and defined escalation paths.

RJ PRO Tech Group provides managed IT and cybersecurity services to Valley Springs businesses, including monitoring, backup and disaster recovery, and ransomware protection, to help build that groundwork.

FAQs

Should I turn off a computer during a ransomware attack?
Disconnect it from the network first. Powering off can erase volatile evidence, so shut it down only if isolation is not possible.

Should I restore my backups immediately after ransomware?
No. Confirm the attacker is contained, credentials are secured, and the backup predates the compromise. Otherwise you may restore the problem along with the data.

Can ransomware infect or delete backups?
Yes. Attackers often target them. Backups on the same network, or reachable with stolen credentials, are easy targets. Trust depends on isolation, access controls, and whether anyone has tested a restore.

How long does ransomware recovery take?
Depends on how far the attackers got and what your backups are like. Some businesses have critical systems back up and running in days, but full recovery can take weeks.

Does paying the ransom guarantee recovery?
No. It can also create legal or sanctions issues, so get advice from counsel, your insurer and security professionals before you decide.