Ransomware Incident Response: Pay, Disconnect, or Report?

When ransomware strikes, the first question is whether to pay the ransom, disconnect systems, or report the attack. The short answer: disconnect affected systems immediately to contain the spread, report the incident to law enforcement and relevant authorities, and do not pay the ransom unless you have exhausted all other options and have expert legal and technical guidance. This article explains the reasoning behind each step and provides a practical framework for your response.

Formula

The risk score above is a simplified heuristic to illustrate how response time, scope, and ransom size influence urgency. The formula is:

Risk = min(100, (time_hours × 5) + (systems_affected × 3) + (ransom_usd / 5000))

• time_hours: hours since infection (input, hours)
• systems_affected: number of computers or servers impacted (input, count)
• ransom_usd: amount demanded (input, US dollars)
• Risk: output on a 0–100 scale, where higher means more urgent action needed

Worked Example

Using the default values: 6 hours since infection, 10 systems affected, and a $50,000 ransom.

Step 1: Multiply time by 5 → 6 × 5 = 30
Step 2: Multiply systems by 3 → 10 × 3 = 30
Step 3: Divide ransom by 5000 → 50000 / 5000 = 10
Step 4: Sum → 30 + 30 + 10 = 70
Step 5: Cap at 100 → 70

The risk score is 70, indicating a high urgency situation. This is not a real security metric but a way to visualize how delays and scope escalate risk.

Why Disconnecting Systems Is the First Move

Ransomware often spreads laterally through networks, encrypting file shares, databases, and backups. Disconnecting infected machines from the network (both wired and Wi-Fi) stops the encryption in its tracks and preserves evidence. Do not turn off the computer entirely—a running system keeps volatile memory (RAM) intact, which forensic investigators may need. Instead, unplug the network cable or disable Wi-Fi, and if you must power down, document the time and state first.

Also disconnect any network-attached storage (NAS) and cloud sync clients. If backups are stored on a separate network segment, isolate them immediately to prevent the ransomware from encrypting those too. The goal is to contain the blast radius before anything else.

Reporting the Incident: Who and When

Reporting is not optional in many jurisdictions. Laws like the U.S. SEC rules for public companies, GDPR in Europe, and various state breach notification laws require reporting within specific timeframes (often 72 hours). You should report to:

• Local law enforcement (e.g., FBI Internet Crime Complaint Center or local police)
• National cyber security agencies (e.g., CISA in the U.S., NCSC in the UK)
• Your cyber insurance provider (they often have incident response teams on retainer)
• Legal counsel to understand your notification obligations

Report as soon as you have confirmed the attack, even before you know the full scope. Early reporting can help authorities track the attackers and may provide you with decryption tools if they exist. Do not wait until you have decided whether to pay.

Should You Pay the Ransom? The Real Trade-offs

The FBI and CISA explicitly advise against paying ransoms. Paying does not guarantee you get your data back—studies show a significant percentage of victims who pay never receive working decryption keys. It also funds criminal enterprises and makes you a repeat target. However, in some cases—such as when backups are unavailable and the data is critical for patient safety or business survival—organizations may feel they have no choice.

If you are considering paying, you must first:

• Check with legal counsel about sanctions—paying a sanctioned group can be illegal.
• Verify the decryption tool actually works on a test machine before paying the full amount.
• Negotiate—many attackers will lower the price if you show you cannot pay the full sum.
• Understand that payment may not prevent data leaks; many groups steal data before encrypting and threaten to publish it.

In short, paying is a last resort, not a first response. Exhaust all recovery options first.

Common Mistakes During Ransomware Response

Even well-meaning responders make errors that worsen the situation. The most common include:

• Rebooting infected machines—this can destroy evidence and sometimes triggers additional encryption.
• Running antivirus scans on infected systems—this can modify files that forensic tools need.
• Deleting the ransom note—the note often contains a unique ID and instructions that investigators need.
• Not preserving logs—firewall, endpoint, and server logs are crucial for tracing the entry point.
• Restoring from backups without cleaning the network—if the attacker is still inside, they will re-encrypt the restored data.

Take a methodical approach: document everything, preserve evidence, and involve professionals early.

How to Choose Between Paying and Not Paying

There is no universal answer, but a decision matrix can help. Consider these factors:

• Availability of clean backups—if you have tested backups, you can likely restore without paying.
• Criticality of data—is it life-safety (hospitals) or legal (court records)?
• Cost of downtime—compare the ransom to lost revenue per day of outage.
• Legal and regulatory constraints—some industries prohibit payments to certain entities.
• Reputation risk—will paying become public and damage trust?

If you have backups, the decision is easy: do not pay. If you lack backups, you must weigh the odds of getting data back against the cost. Remember, even if you pay, you still need to rebuild and clean your systems—payment does not fix the underlying vulnerability.

Costs and Alternatives to Paying

The true cost of a ransomware incident extends far beyond the ransom. You will likely spend on:

• Incident response firms (forensics, containment, eradication)
• Legal fees and breach notification costs
• Business interruption losses
• Rebuilding systems and restoring data
• Increased insurance premiums

Alternatives to paying include:

• Restoring from offline backups—the most reliable method.
• Using free decryption tools—sites like No More Ransom (by Europol and cybersecurity companies) offer tools for some ransomware variants.
• Negotiating for a lower payment—if you must pay, at least reduce the amount.
• Seeking help from law enforcement—they may have decryption keys or intelligence.

Investing in backups and a tested incident response plan is far cheaper than any ransom payment.

Frequently Asked Questions

Should I turn off my computer if I suspect ransomware?

Do not turn it off—unplug the network cable or disable Wi-Fi to stop the spread, but leave the machine running. Turning it off may destroy volatile memory that forensic experts can use to identify the attack vector. If you must power down, do so only after documenting the state and ideally after consulting with an incident responder.

Do I have to report a ransomware attack?

In many jurisdictions, yes. Public companies in the U.S. must report material cyber incidents to the SEC within 4 business days. GDPR requires notification to supervisory authorities within 72 hours if personal data is breached. Even if not legally required, reporting to law enforcement can help you recover data and prevent others from being victimized.

Can I get my files back without paying?

Sometimes. If you have clean, offline backups, you can restore without paying. Some ransomware variants have free decryption tools available through initiatives like No More Ransom. Law enforcement may also have decryption keys. However, for many modern ransomware families, there is no free tool, and recovery without backups is unlikely.

What if the ransomware also stole my data?

Many ransomware groups now steal data before encrypting and threaten to leak it if you do not pay. This is called double extortion. Even if you pay, they may still leak the data. You should assume the data is compromised and follow breach notification laws, which may require informing affected individuals. Contact law enforcement and consider credit monitoring for affected customers.

How do I know if my backups are safe from ransomware?

Backups are only safe if they are offline or immutable. That means they are not continuously connected to the network and cannot be modified or deleted by an attacker. Test your backups regularly by restoring a few files to a clean machine. If your backups are on the same network as your production systems, assume they are compromised.

Will paying the ransom guarantee I get my data back?

No. There is no guarantee. Some attackers provide working decryption tools, but many do not. Even when they do, the tool may be buggy and damage files. Paying also marks you as a willing payer, increasing the likelihood of future attacks. The FBI and CISA advise against paying, and many cybersecurity experts agree.

Related

• File Can’t Be Found Mac Startup? Fix It Now
• Tint iPhone Home Screen Icons to Match Your Case in iOS 26
• Travel Cases for Apple Watch: What to Know

in t | Time since infection | hours | 6 | 0
in d | Systems affected | count | 10 | 1
in c | Ransom amount | USD | 50000 | 0
out risk | Risk score (0-100) | - | min(100, (t * 5) + (d * 3) + (c / 5000)) | 0