Ransomware: the right reflexes before, during and after
Ransomware encrypts your files and demands a ransom to restore them. The damage depends above all on what was prepared before the attack and on the first decisions taken.
Kayzen Security editorial team3 min read
Before: reduce the risk and the impact
- Regular backups, including at least one copy disconnected from the network, and tested restoration.
- Prompt updates to systems, software and internet-facing equipment (VPN, email, remote access).
- Multi-factor authentication on remote access, email and administrator accounts.
- Limited privileges: users do not work with an administrator account.
- Endpoint protection (antivirus, malicious site filtering) and vigilance with attachments.
- A written response plan: who to call, how to isolate, where the backups are, how to work in degraded mode.
During: the first few minutes
- Disconnect the device from the network (cable, Wi-Fi) to limit the spread. Do not format it: it contains traces useful to the investigation.
- Immediately notify your IT provider or your security contact.
- Disconnect any backups that are still plugged in to protect them.
- Do not pay the ransom: this is the consistent recommendation of the authorities. Nothing guarantees that the data will be recovered, and it funds the attackers.
- Note the time, the messages displayed and the actions taken.
After: report, investigate, restart
- File a complaint with the police or gendarmerie, and get guidance from 17Cyber (17cyber.gouv.fr) towards local providers.
- If personal data is affected, assess whether you must notify the CNIL within 72 hours (GDPR article 33) and, in the event of a high risk, inform the people concerned.
- If your organisation falls under NIS2, specific reporting deadlines apply with the competent authority.
- Visit the No More Ransom website (Europol and partners): it offers free decryption tools for certain ransomware families.
- Identify the entry point, fix it, reset passwords, then restore from clean backups.
- Businesses insured against cyber risk: the French insurance code (article L.12-10-1) makes compensation conditional on filing a complaint no later than 72 hours after the attack is discovered. File a complaint without delay, then notify your insurer. To be confirmed with your insurer or a professional.
Official sources
- 17Cyber (new tab) — Le réflexe en cas de cybermalveillance (Police nationale, Gendarmerie nationale, Cybermalveillance.gouv.fr)
- Cybermalveillance.gouv.fr (new tab) — Assistance et prévention en sécurité numérique (fiches réflexes, prestataires ExpertCyber)
- No More Ransom (new tab) — Outils de déchiffrement gratuits (Europol et partenaires)
- CNIL (new tab) — Commission nationale de l'informatique et des libertés
- ANSSI (new tab) — Agence nationale de la sécurité des systèmes d'information — guides et publications
The resources cited are published by their authors in their original language. Kayzen is not affiliated with any of these organisations.
This guide is general and for information only. It does not replace legal advice or the help of an IT security professional.