A response plan for a ransomware attack on the firm

Recognizing the attack and isolating the systems

The first signs are files that no longer open, changed extensions and an on-screen ransom demand. The moment ransomware is suspected, the absolute priority is to stop it from spreading: disconnecting the computer from the network, turning off wifi and unplugging any shared drives prevents the encryption from reaching the firm's other systems.

If possible, do not shut down the affected computer: its memory may hold information useful for the analysis. Isolating the backup media at once is equally important, because many ransomware strains specifically look for the spare copies to render them unusable and force payment.

Assessing the damage before reacting

Before any decision you need to understand the scope of the damage: which machines are affected, which data is encrypted and whether the cloud management system, which runs on separate infrastructure, remained intact. A firm working in the cloud has a decisive advantage, because the main data does not reside on the affected computer.

You must also assess whether the data was only encrypted or also copied to the outside. Exfiltration turns the incident into a possible personal data breach with stricter notification obligations. Every observation should be recorded: it will be needed for the restore, for the communication to owners and for any report.

• Scope: which computers and media are affected
• Data: what is encrypted and what remained intact in the cloud
• Exfiltration: determine whether the data was copied outside
• Backups: identify the last clean copy to start from

Why not to pay the ransom on impulse

Paying the ransom does not guarantee the data will be recovered and it fuels further attacks. The correct strategy is to restore from backups: if the firm has applied a solid rule, with at least one offline or immutable copy, the ransom route becomes unnecessary. This is precisely why a copy isolated from the network is the most effective defence against ransomware.

The decision, should it ever arise, must be taken with a cool head and the support of a competent technician, not in the first minutes of panic. The written plan exists precisely to remove the emotional urgency and follow a rational sequence.

Restore and obligations to the authority and the owners

The restore starts from the last copy verified as intact, giving priority to the most critical data: accounting in progress, financial reports, owners' register. Before reconnecting the systems you must make sure the threat has been removed, otherwise the restored data would be encrypted again.

If owners' personal data is involved, Article 33 of Regulation EU 2016/679 requires you to assess notifying the breach to the supervisory authority within 72 hours of becoming aware of it, unless the breach is unlikely to result in a risk to the individuals. Where the risk is high, the individual owner must also be informed. Keeping documentation of the incident and the countermeasures is part of the accountability obligation.

Reducing the risk with AmministraPro

Keeping management data on a cloud platform like AmministraPro reduces the firm's attack surface: accounting, documents and the owners' register do not reside on the individual computer, so ransomware hitting one workstation does not compromise the central archive, which is protected and replicated on dedicated infrastructure.

Discover the security and archiving features on the /funzioni page and evaluate the plans on the /prezzi page to set up a firm more resilient to IT incidents.

Frequently asked questions