What Should a Small Business Do If It Gets Hit by Ransomware?

The short answer

Ransomware is malicious software that locks or steals your files and demands payment. If it hits, disconnect infected devices from the network right away, call your information technology (IT) help and cyber insurer, report it to the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA), and restore from clean, offline backups. Law enforcement does not recommend paying, and paying may not get your data back.

What this tells Google and AI

Ransomware planning is a foundation step with no direct search signal. But an attack can take down your website, lock you out of the accounts that manage your Google Business Profile (GBP) and listings, and stall your replies to customers and reviews. While you’re down, Google, Bing, and artificial intelligence (AI) tools keep showing whatever they last read, which may be wrong. A ready plan and offline backups shorten that time.

What this means

Ransomware usually gets in through a phishing email, a stolen password, or software that wasn’t updated. Once inside, it encrypts files so you can’t open them, and it may copy your data first and threaten to publish it.

A ransomware plan covers four things the outline asks for:

• Isolation: stop the spread by cutting infected devices off the network.
• Reporting: tell law enforcement, your insurer, and others who need to know.
• Restoration: rebuild clean systems and restore from backups.
• Communication: tell staff, customers, and partners what they need to know, honestly.

Made-up example: The front desk computer at Willow Creek Physical Therapy shows a ransom note. The office manager unplugs the network cable and turns off Wi-Fi on that computer, then calls the owner from her cell phone. The owner calls their IT provider and their cyber insurer, reports to the FBI, and restores the scheduling data from an offline backup made the night before. Because patient data may have been copied, they call their attorney about notice rules.

Why it matters

• It spreads fast to shared drives and other computers.
• Online backups can be encrypted too. The Federal Trade Commission (FTC) says to keep backups not connected to the network.
• Data theft can mean a breach notice, even if you restore everything (see 11.6.6 Breach Notification).
• Paying doesn’t guarantee anything. The FTC notes paying may not get your data back.

Who this applies to

Every business that uses computers, cloud storage, or a website. Small businesses are targets because they often lack offline backups.

How to do it

Prepare now:

1. Keep offline backups and test them (see 11.8 Business Backups and 11.8.8 Backup Recovery Test).
2. Install updates on computers, phones, and your website promptly (see 13.2.7 Website Security Updates).
3. Turn on multi-factor authentication for email and remote access (see 11.7.3 Multi-Factor Authentication).
4. Train staff to spot phishing (see 11.6.7 Privacy Training).
5. Print a response card with phone numbers for your IT help, insurer, attorney, bank, and local FBI field office. Keep it off the computer.
6. Read your cyber insurance policy to learn who to call first (see 10.8.6 Cyber Insurance).

If it happens:

1. Disconnect. Unplug network cables and turn off Wi-Fi on infected devices. CISA suggests taking affected systems offline to stop the spread.
2. Don’t wipe anything yet. Evidence helps investigators and your insurer.
3. Talk by phone, not by company email, in case attackers can read it.
4. Call your IT help and insurer.
5. Report it. CISA lists CISA, your local FBI field office, the FBI’s Internet Crime Complaint Center (IC3) at IC3.gov, and the U.S. Secret Service as places to report.
6. Change passwords from a clean device, starting with email and admin accounts.
7. Rebuild and restore from clean, offline backups, most important systems first. CISA warns to check for leftover malware so you don’t reinfect.
8. Decide on notices with your attorney if data may have been taken (see 11.9.4 Data Breach Response).
9. Tell customers and staff what they need to know. Update your GBP hours or post a notice if service is affected.
10. Review what happened and fix the entry point.

What proof to keep

• The incident log with times and actions
• Photos of the ransom note and screens
• Report confirmation numbers
• Insurer claim number and contacts
• Restore records showing what was restored and when
• Copies of any notices sent

Common mistakes

• Leaving the infected computer connected while you figure things out.
• Backups always plugged in, so they get encrypted too.
• Hiring a cleanup company before calling the insurer. Check your policy first.
• Restoring onto an infected system and getting hit again.
• Paying quickly without law enforcement, insurer, or attorney input.
• Assuming restored files means no breach. Data may have been copied first.

When to get help from a pro

IT security specialist: right away, to contain and rebuild. Cyber insurance agent: to start a claim and follow policy rules. Privacy attorney: if customer or employee data may have been taken. Questions to ask:

• Is the attack contained, and how did it get in?
• Was data copied before it was encrypted?
• What does our policy require us to do, and in what order?

Bill’s note

[Bill: add a short note. For example, a small business you know that lost its website or files to ransomware and how backups did or didn’t help, or how SiteSmarty keeps client websites recoverable.]

How I did this for SiteSmarty

• [Date I did this:]
• [What I actually did, step by step: offline backups, the printed response card, and insurer contacts for SiteSmarty]
• [What it cost and how long it took:]
• [What surprised me or what I’d do differently:]
• [Screenshot or photo to add, with private info blurred: the printed response card and backup schedule]
• [Result so far:]

Questions people ask

Should I pay the ransom? Law enforcement doesn’t recommend it. The FTC says the decision is yours, but paying may not get your data back. Talk to law enforcement, your insurer, and an attorney first.

Who do I report ransomware to? CISA lists CISA, your local FBI field office, IC3.gov, and the U.S. Secret Service.

How do I get my files back? Restore from clean, offline backups after the threat is removed. Ask law enforcement whether a free decryption tool exists for your ransomware type.

How do I keep running during an attack? Follow your written plan, use offline backups, switch to phone and paper where needed, and post updated hours or notices for customers.

Audit check

• Question: Does the business have offline, tested backups and a written ransomware response plan with contacts stored off the computer?
• Pass looks like: Offline backups tested on schedule, a printed response card, insurer and IT contacts, updates and multi-factor authentication in place, and staff who know to disconnect and call.
• Fail looks like: Backups always connected, no plan, contacts stored only on the computer that could be locked.
• Evidence to collect: Backup test log, the response card, insurance policy contact page, and training records.

Where this fits

Do this first: 11.8 Business Backups, 11.8.8 Backup Recovery Test, 11.9.2 Account Takeover

Do this next: 11.9.4 Data Breach Response

Related pages: 11.6.6 Breach Notification, 10.8.6 Cyber Insurance, 13.2.7 Website Security Updates, 11.6.7 Privacy Training, 22.9 Emergency Procedures, 11.9.9 Platform Suspension Plan

Sources

• Cybersecurity and Infrastructure Security Agency, "I've Been Hit By Ransomware!" (checked October 17, 2026)
• Federal Trade Commission, "Cybersecurity for Small Business" fact sheets (checked October 17, 2026)
• Federal Trade Commission, "Data Breach Response: A Guide for Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.