It usually starts with a phone call or a confused message on the office WhatsApp group: "I can't open any of my files. There's a note on my screen asking for Bitcoin."
What you do in the next hour has a big effect on how bad the next month will be. Act quickly and calmly, and you can often limit the damage to a handful of machines. Panic, and the infection can spread to every computer, server and backup you own.
This guide is written for South African business owners and managers. Print it, or save it somewhere that isn't on your company network, because if ransomware strikes you may not be able to open it.
First, what is ransomware?
Ransomware is malicious software that encrypts your files so you can't open them, then demands payment for the key. Many modern ransomware gangs also steal a copy of your data first and threaten to publish it if you don't pay. That second part matters, because it can turn an IT problem into a POPIA breach.
Minutes 0–10: stop the spread
1. Disconnect affected computers from the network, but don't switch them off. Unplug the network cable and turn off Wi-Fi. On a laptop, switch on flight mode. Leave the machine powered on: memory can hold clues (and sometimes keys) that investigators need, and a power cycle can trigger further damage.
2. Check the machines around it. Ask everyone in the office to save their work and look for warning signs: files with strange new extensions, a ransom note, programs that won't open, or a computer running unusually slowly. Disconnect any machine that shows symptoms.
3. Protect your backups. If you have an external backup drive plugged in, unplug it now. If backups go to a NAS or a cloud folder that's synced to your computers, disconnect or pause the sync. Ransomware actively hunts for backups.
4. Don't touch the ransom note, but photograph it. Take a photo with your phone. Note the time, which computer it appeared on and anything the note says about the attackers or a deadline. Don't click any links in it and don't contact the attackers.
Minutes 10–30: get the right people involved
5. Call your IT support or security provider. If you have an incident response plan, this is when you open it. Tell them what you've seen and what you've already disconnected. If you don't have an IT provider, look for a reputable incident response firm. Your cyber insurer may have a panel they want you to use.
6. Phone your cyber insurer, if you have cover. Many policies require you to notify them promptly, and some will only pay for specialists they approve. Calling early protects your claim.
7. Switch to clean communication channels. Assume your company email may be compromised. Use phones and personal messaging to coordinate, and keep the circle small. Agree who is in charge of the response. One decision-maker is better than five.
8. Lock down key accounts. From a device you're confident is clean (a personal phone, not an office PC), change the passwords for:
- your email administrator account (Microsoft 365 or Google Workspace)
- online banking
- your accounting system
- any remote access tools your IT provider uses
Make sure multi-factor authentication is switched on for each. If you notice admin accounts you don't recognise, tell your IT provider immediately.
Minutes 30–60: understand the damage and your obligations
9. Work out what's affected. With your IT provider, build a simple list: which computers and servers are encrypted, which are clean, which file shares and cloud accounts the affected users could reach. This tells you how far the attackers could have got.
10. Think about personal information. Did the affected machines hold client records, patient files, employee information or ID numbers? If personal information may have been accessed or taken, POPIA section 22 requires you to notify the Information Regulator and the affected people as soon as reasonably possible. You don't need to do this in the first hour, but you should start the conversation now, with your Information Officer and, ideally, your attorney. Our guide on how to report a POPIA data breach walks through the process.
11. Alert your bank if financial systems are involved. Attackers sometimes combine ransomware with payment fraud: changing supplier bank details or sending fake invoices from your email account. Warn your bank and your finance team to double-check every payment request by phone.
12. Report the crime. Ransomware is a crime under the Cybercrimes Act. Open a case with the South African Police Service; your insurer will usually want a case number. Some sectors, such as financial institutions, have specific reporting deadlines, so check whether one applies to you.
What not to do
- Don't pay the ransom on impulse. Paying doesn't guarantee you'll get your files back, it doesn't stop the attackers publishing stolen data, and it marks you as a business that pays. If payment is ever considered, it should be a deliberate decision made with specialists, your insurer and legal advice.
- Don't wipe and reinstall straight away. It's tempting to "just fix it", but you'll destroy the evidence you need to understand how they got in, and you may not be able to prove what data was or wasn't taken.
- Don't reconnect anything until it's been checked. Restoring a backup onto a network that still has an attacker on it simply gives them a second go.
- Don't keep it quiet from staff. People who don't know what's happening keep clicking, plugging in drives and logging in.
After the first hour
The recovery phase takes days, not minutes: finding how the attackers got in, removing them completely, rebuilding systems and restoring clean backups. Check nomoreransom.org, a project run by law enforcement and security companies. For some older ransomware families, free decryption tools exist.
Most importantly, once the dust settles, sit down and ask: how long were they inside before we noticed? In many ransomware cases, attackers are on the network for days or weeks beforehand, logging in, exploring and switching off defences. Those warning signs are visible if something is watching.
Be ready before it happens
A one-hour plan works best when you've prepared for it:
- Backups you've tested, with at least one copy offline.
- A printed contact list: IT provider, insurer, bank, attorney, Information Officer.
- Multi-factor authentication on email, banking and remote access.
- Monitoring that spots the early signs, such as unusual log-ins, new admin accounts, mass file changes and disabled antivirus, before encryption starts.
EZ Cyber Guard monitors your devices around the clock, explains suspicious activity in plain language and can automatically contain common threats, so you find out about trouble while it's still small.