The short answer: Disconnect the affected computers from the network immediately — pull the cable, switch off Wi-Fi. Any machine where encryption is still running should be powered off hard; machines where it has already finished should be left running but disconnected, as they may hold forensic traces. Delete nothing, reinstall nothing, and do not connect your backups until you have verified that they are clean and that the way the attacker got in is closed. Do not pay the ransom in a panic on day one — without a diagnosis you have no idea what can be recovered by other means. Encrypted data with no backup belongs in a lab, not in a round of DIY attempts.
Monday morning: the bookkeeper cannot open the invoices, files on the server have a strange extension, and every folder contains a text file explaining where to send the payment. This is not a scenario reserved for corporations with a security team — it happens to companies of five, twenty, fifty people. The next 24 hours decide whether the incident costs you days of work or the very data the business runs on. This text is a procedure for owners and managing directors of small companies with no security specialist on staff.
Why this matters even with twenty employees
According to the trade magazine Professional Computing, the number of known ransomware victims in the Czech Republic doubled year over year: 12 companies in the first quarter of 2026 against 6 in the same period of 2025. And those are only the publicly known cases — incidents at small companies usually never make it into the statistics at all, because nobody reports on them. Active gangs such as Gentlemen, Akira and Qilin target manufacturing, technology firms and retail — precisely the segment where security typically rests on a single external IT guy.
The way in is almost always mundane: in 42 % of cases a guessed weak password, followed by remote desktop (RDP) exposed to the internet and unpatched systems.
A widely reported case from Brno shows what this looks like in practice: a construction company with 25 employees had the password „stavba123" on a server with remote desktop enabled. The result — damage of over CZK 500,000, two weeks of restoring operations, and the irrecoverable loss of three years of project documentation. No zero-day, no sophisticated attack. One weak password on a service exposed to the internet.
Hour 0–1: isolate, but do not power everything off
The first hour has a single goal: stop the spread. Ransomware crawls from one machine across shared folders, mapped drives and domain accounts to other computers and servers.
- Disconnect the affected machines from the network. Pull the network cable, switch off Wi-Fi. This is the first and most important step — encryption on one machine is a nuisance, an encrypted network is a catastrophe.
- Power off hard any machine where encryption is still running. You will recognise it by the growing number of files with an unfamiliar extension and by heavy disk activity. Every minute it keeps running means more originals encrypted and deleted.
- Machines where encryption has already finished should be left running — disconnected. Encryption keys and traces of the attacker may remain in RAM, and forensic analysis can make use of them. Powering the machine off loses them.
- Disconnect the NAS and external backup drives. If backups are attached as a network share, the attacker encrypted or deleted them first. Whatever is disconnected is safe — do not plug it back in „just to check".
- Consider disconnecting the whole company from the internet. On a smaller network, the safest move is to pull the WAN cable out of the router. That cuts off the attacker’s remote access.
- Photograph the screens with the payment demand. The text, the file extensions and the attackers’ contact addresses will be needed both to identify the variant and for reporting.
- Write down a timeline. Who noticed what and when, and what everyone has done since. In two hours nobody will remember, and it matters for both the insurer and the police.
Hour 1–4: establish the scope and the variant
Only once nothing else is being encrypted does it make sense to find out what actually happened.
Go through the machines one by one — including servers, NAS devices and the computers of people working from home. You are looking for unfamiliar file extensions, payment demands, and machines behaving oddly. Do not log in to suspect machines as a domain administrator: if the attacker is still inside, you are handing them the most valuable account in the company.
Identify the ransomware variant. The family can usually be determined from the file extension and the text of the demand using free services such as ID Ransomware or No More Ransom. Public decryption tools exist for some older campaigns — it is worth checking before you pay anything.
Check the state of your backups — on a clean, disconnected computer. This is the single most important finding of the whole day: do you, or do you not, have a working backup? Watch out for three traps. Ransomware typically deletes Windows shadow copies before encrypting, so „restore previous versions" will not work. Cloud sync (OneDrive, Google Drive) dutifully uploaded the encrypted versions too — look for version history there. And a backup on a permanently connected drive most likely met the same fate as the original; why one copy is not a backup is covered in the article on external HDDs and the 3-2-1 rule.
What to avoid in the first few hours
- Do not delete encrypted files and do not try to „clean" the system with an antivirus. With a number of variants, some of the data can be recovered forensically — every write to the disk lowers that chance.
- Do not reinstall servers or workstations until it is clear what can be salvaged from the drives and what you will need as evidence.
- Do not restore backups into a compromised network. As long as the attacker’s way in is still open, you will lose the backup as well.
- Do not communicate with the attackers in a panic. Answering within the first hour speeds nothing up, and negotiating without a plan means negotiating badly.
- Do not pay the ransom on day one. We will come back to this — but the decision to pay or not should follow the diagnosis, not the panic.
Who to report the incident to
Small companies often underestimate their reporting obligations — and fines and insurance payouts hang on them.
- NÚKIB (the Czech National Cyber and Information Security Agency). If your company falls under the new cybersecurity act (264/2025 Sb., in force since 1 November 2025) as a provider of a regulated service, you are obliged to report a significant incident to NÚKIB through its portal. Other companies may report an incident voluntarily — NÚKIB uses the data to warn others. Whether the act applies to you is best verified before an incident, not during one.
- ÚOOÚ (the Czech data protection authority). If the attack touched personal data (payroll, customers, job applicants — which is almost always the case), it is a personal data breach under the GDPR. That must be reported to the Office for Personal Data Protection within 72 hours of discovery, unless the risk to the individuals concerned is unlikely. With today’s attacks, which steal the data first and only then encrypt it, do not count on that exemption.
- The Czech Police. Extortion and unauthorised access to a computer system are criminal offences. A criminal complaint also serves as supporting documentation for the insurer.
- Your insurer. If you have cyber insurance (or even just business interruption cover), report the incident without delay — policy terms often require notification within hours and approval of how you proceed.
Hour 4–24: recovery, but in the right order
The biggest mistake in the second phase: restore everything quickly and carry on. If you do not close the way in, the attacker will be back — this time for the backups too.
- Find and close the entry vector. Exposed RDP, VPN without two-factor authentication, a guessed password, an unpatched server. Without this step, every restore is just preparation for a repeat performance.
- Change every password. Start with the domain administrator, service accounts and the VPN. Treat everything that was stored on the network as compromised.
- Restore into a clean environment. Compromised machines get reinstalled from clean installation media, not „cleaned". Check backups on an isolated machine before deploying them.
- Set the order by business priority. First whatever keeps the company running: accounting, production, the warehouse, email. The rest can wait.
- Monitor the network for the first few weeks. Attackers returning to networks they have already hit is common — getting back into an environment they know is cheap for them.
When there are no backups: what can still be saved
The scenario of the Brno construction company — no backup, or a backup that met the same fate as the original — does not automatically mean the end. Ransomware typically encrypts files into a new copy and deletes the original rather than overwriting it. At the file system level, part of the original data therefore physically remains until something overwrites it. On a NAS, snapshots may also have survived if the attacker did not deliberately delete them — we describe the whole mechanism in the article on ransomware on a NAS, and the procedures for company servers in the text on server data recovery.
In practice this means: take the encrypted drives out of service, write nothing to them, and have them go through diagnostics. In our Brno lab, diagnostics are free and without obligation — you will learn what can realistically be recovered from the drives before you decide whether it is even worth discussing a ransom. No recovery – no fee applies.
Why not to pay the ransom straight away
We are not saying „never„ as a matter of dogma — we are saying „not on day one and not without information". The reasons:
- You have no guarantee. You are paying criminals; a working decryption key is not a given, and with some variants decryption damages the data.
- Payment does not undo the data theft. Most current campaigns steal the data first and encrypt it only afterwards (so-called double extortion). Paying does not make the reporting duties towards ÚOOÚ disappear, nor the risk that the data will leak anyway.
- It may be possible without paying. Surviving backups, snapshots, forensic recovery of deleted originals or a public decryptor — diagnostics will reveal all of that within days.
- Whoever pays is marked as a paying target. And the amounts are not random — attackers calibrate them so that paying up „makes sense" for a small company.
The rational approach: diagnostics and legal advice first, and only then a possible decision to pay as the last resort.
The next 30 days: making sure it does not happen again
An incident is the strongest argument there is for the order that should have been in place beforehand. The minimum after recovery:
- Never expose RDP and admin interfaces directly to the internet — only through a VPN with two-factor authentication.
- Backups following the 3-2-1 rule, with at least one copy offline or immutable — that is, one an attacker with admin rights cannot delete.
- Updates and an overview of the network. An unpatched server and a forgotten device are the two most common holes; what such an overview uncovers is described in the article on network and cabling audits.
- A test restore. A backup you have never restored anything from is just hope.
And above all: somebody has to keep all of this going, consistently. If you do not have your own IT person, this is exactly what our IT security for businesses service covers — from closing entry vectors through monitored backups to a plan for what to do when something happens. It is always the cheaper option compared with a second incident.
Frequently asked questions
Ransomware — what should I do first?
Disconnect the affected machines from the network (cable out, Wi-Fi off), stop encryption in progress by powering that machine off hard, and disconnect the NAS and backup drives. Only then start working out the scope. Delete nothing, reinstall nothing, pay nothing.
Do we have to report an incident if we are a small company?
To NÚKIB only if you fall under the cybersecurity act (264/2025 Sb.). But a personal data breach must be reported to ÚOOÚ within 72 hours regardless of company size — and practically every company holds personal data (payroll, customers).
Can encrypted data be recovered without paying?
Often partly yes: from surviving backups and snapshots, by forensic recovery of deleted originals, and with older campaigns using a public decryptor. The extent cannot be promised in advance — which is why diagnostics come first, free and without obligation in our case.
How much does such an attack cost a small company?
From publicly described Czech cases: the Brno construction company over CZK 500,000 and two weeks of downtime, plus the irrecoverable loss of three years of project documentation. The costs come mainly from downtime and recovery, not from the ransom.
Will the attackers come back?
The risk is real if you do not close the way they got in and do not change the passwords. That is why recovery is done into a clean environment and the network is monitored for several weeks after the incident.