How to prepare for and recover from a ransomware attack

March 30, 2017

Ransomware is malicious software that locks you out of your own files, usually by encrypting them, and then demands payment for a key. Many modern gangs also copy data before encrypting it and threaten to publish it. It hits home users, charities and businesses of every size, and it remains one of the most disruptive threats in the UK.

The GOV.UK Cyber Security Breaches Survey 2025/2026 found that 43% of businesses and 28% of charities had a breach or attack in the previous 12 months, with phishing affecting 38% of businesses. At the national level, the NCSC’s 2025 Annual Review reported 429 incidents, 204 of them nationally significant: about four a week. How well you prepare decides how quickly you recover.

How ransomware gets in

Phishing emails with malicious links or attachments, often disguised as invoices, deliveries or shared documents.
Stolen or weak passwords, especially on remote access such as Remote Desktop (RDP) or VPNs without two-step verification.
Unpatched software on computers, servers, firewalls and NAS boxes exposed to the internet.
Compromised websites and downloads, including fake software updates.

Once inside, ransomware typically spreads across the network, encrypting shared drives, servers, NAS devices and any backup it can reach, including cloud folders that sync automatically.

Before an attack: reduce the risk

Keep everything updated. Turn on automatic updates for operating systems, apps, browsers and device firmware.
Use strong, unique passwords and two-step verification on email, remote access, cloud services and admin accounts.
Disable remote access you do not need, and never leave RDP open directly to the internet.
Train people. Many attacks start with a click. Teach staff to check unexpected attachments and links, and make it easy to report a suspicious email without blame.
Limit access. Give staff only the shares and admin rights they need, so one infected laptop cannot reach everything.
Use reputable security software and email filtering, and keep them current.

Backups: the thing that actually saves you

A good backup turns a ransomware attack from a disaster into an inconvenience. The NCSC advises backing up anything you value, using automatic or cloud backups, and disconnecting removable backup drives when they are not in use so they cannot be encrypted too.

Follow the 3-2-1 rule of thumb: three copies of your data, on two different types of media, with one kept off-site.
Keep at least one copy offline or immutable. A USB drive left plugged in, or a cloud folder that syncs every change, can be encrypted along with everything else. Versioned or immutable cloud backup lets you roll back to a clean copy.
Cover all your data. Check that laptops, servers, NAS devices, email and cloud apps are all included, not just the main file server.
Back up often enough that you could live with losing everything since the last backup, and keep enough history to go back before an infection started.
Test restores regularly. A backup you have never restored from is a hope, not a plan.

The same GOV.UK survey found that 74% of businesses use secure cloud backup, but only 25% have a formal incident response plan. Writing down who does what in an attack is cheap and makes a real difference. Our business backup guide covers this in more detail.

During an attack: what to do

Isolate infected devices. Unplug network cables and turn off Wi-Fi to stop the spread. Disconnect backup drives and NAS boxes from the network.
Do not wipe or reinstall straight away. Note the ransom message and what happened first; this helps investigators and your insurer.
Do not rush to pay. Paying funds criminals, may not get your files back, and does not stop them publishing stolen data. Check whether a free decryptor exists through the No More Ransom project.
Report it. Report the attack to Action Fraud and, for organisations, to the NCSC. If personal data may be affected, consider your UK GDPR duty to report to the ICO.
Tell your users what has happened and what they should and should not do.
Find the entry point (a phishing email, a stolen password, an exposed service) and close it before you restore.
Restore from a clean backup onto rebuilt or reimaged systems, starting with the most important ones.

Where a data recovery lab can and cannot help

To be clear, no honest data recovery lab can break modern ransomware encryption, and we do not claim to. Where we can help is when the recovery itself goes wrong: a backup drive that has failed, a NAS or RAID array that will not rebuild, or a server disk that has physically died during the incident. In those cases we work from a sector-by-sector copy, never the original, and handle your data under UK GDPR. See our RAID and server recovery and NAS recovery pages.

Need help with a failed backup or server?

We offer a free initial assessment and a fixed, no-obligation quote before any recovery starts, with an emergency service for business-critical systems. Call 020 7064 4996 (Mon–Sat 09:00–18:00) or book your case online.