A ransomware alert at 9.15am can stop far more than email. Staff may lose access to customer records, accounts systems, shared files, phones or cloud applications just as the working day begins. This SME ransomware recovery guide sets out what to do when an attack is suspected, how to restore safely, and how to make the next incident less disruptive.
The first objective is not to get every system back immediately. It is to stop the attack spreading, preserve evidence and restore the services your business needs most without bringing the threat back into the environment.
SME ransomware recovery guide: the first hour
Speed matters, but rushed actions can make recovery harder. If a device displays a ransom note, files suddenly carry unfamiliar extensions, or users report being locked out of accounts, treat it as a security incident until proven otherwise.
Immediately isolate affected computers and servers from the network. Disconnect network cables and disable Wi-Fi where possible. If a device is actively encrypting files, do not let it continue communicating with shared storage, cloud synchronisation tools or other machines. Avoid rebooting it unless instructed by your incident response provider, as valuable evidence may be lost.
At the same time, protect identity systems. Ransomware groups increasingly gain access through compromised Microsoft 365 accounts, remote access services or administrator credentials before they encrypt anything. Disable suspicious accounts, revoke active sessions, reset privileged passwords from a known-clean device and enforce multi-factor authentication where it is not already in place.
Nominate one person to coordinate communications. Staff need clear instructions on what they can and cannot do, including not connecting personal devices, deleting suspicious emails or attempting their own fixes. A short, controlled message is better than a stream of conflicting updates.
Record what happened
Keep a simple incident log from the outset. Record when the issue was discovered, who reported it, which systems appear affected, what containment actions were taken and who has been contacted. Take photographs or screenshots of ransom notes and error messages rather than interacting with them unnecessarily.
This record helps technical teams trace the incident and supports conversations with cyber insurers, legal advisers and, where appropriate, An Garda Síochána. It can also be essential if personal data may have been accessed.
Establish the real scope before restoring
A visible ransom note does not show the whole picture. The affected laptop may only be the point where the attack became obvious. A proper assessment should determine whether the threat actor reached servers, cloud storage, backups, email accounts, remote access tools or other sites.
Your IT provider should investigate how access was gained and whether the attacker still has a route back in. Common entry points include phishing emails, weak or reused passwords, unpatched firewalls or remote desktop services, exposed remote management tools and supplier account compromises.
Do not assume cloud files are safe simply because they are not on a local server. If an infected device has synchronised encrypted files to a cloud platform, those changes may have replicated. Equally, do not assume all backups are usable. Backup systems are a frequent target because attackers know a business is more likely to pay if recovery copies have been deleted or encrypted.
The key question is not just, “Do we have a backup?” It is, “Do we have a clean, complete backup from before the compromise, and can we restore it within an acceptable time?”
Prioritise business services, not individual machines
Recovery should follow business priorities. For many SMEs, payroll, customer communications, finance, stock control and line-of-business applications matter more than restoring every user’s desktop on day one. Agree the order before systems are rebuilt, ideally as part of a documented continuity plan.
A sensible recovery sequence often begins with identity and core network services, followed by secure communications, business-critical applications and then individual endpoints. However, it depends on how your organisation operates. A construction firm may need estimating and project files first; a professional services business may prioritise secure client communications and document management; a retailer may need payment and stock systems ahead of everything else.
Tell staff what is available, what remains unavailable and what temporary process they should follow. If invoicing must be handled manually for a day, give people a controlled process rather than leaving them to improvise. This reduces errors while systems are being restored.
Restore only into a clean environment
Restoring files into an environment that still contains the attacker is one of the most costly ransomware recovery mistakes. Before bringing systems back, remove the original access route, patch known weaknesses, reset credentials and check that security tools are functioning.
Where compromise is widespread, rebuilding devices from known-good images is usually safer than attempting to clean every machine. It may take longer initially, but it provides greater confidence that hidden tools, scheduled tasks or stolen credentials have not been left behind.
Restore data in stages and validate it with the teams who use it. A successful technical restore is not enough if the latest customer records are missing, a database will not open correctly or a critical integration has failed. Check file integrity, application access, user permissions and reporting before declaring a service operational.
Keep restored systems under heightened monitoring. Review sign-in activity, administrator changes, unusual network traffic and attempted access to backup repositories. Attackers may try to return using credentials or tools they established before discovery.
Should you pay the ransom?
Paying is a commercial and legal decision that should never be made in panic. A payment does not guarantee a working decryption key, deletion of copied data or an end to extortion. It can also create further risk if the criminal group already holds sensitive information and threatens to publish it later.
Specialist legal, insurance and incident response advice is particularly important where sanctions, regulatory obligations or sensitive data are involved. The practical focus should remain on containment, evidence preservation and a verified recovery path. Businesses with tested, isolated backups are in a materially stronger position because they have options.
Meet your data protection responsibilities
Ransomware can be a personal data breach if information has been accessed, copied, altered or made unavailable in a way that creates a risk to individuals. Encryption alone may still trigger reporting obligations depending on the circumstances.
For Irish organisations, assess the incident promptly with appropriate data protection advice. Where a notifiable breach has occurred, notification to the Data Protection Commission may be required within 72 hours of becoming aware of it. If there is a high risk to individuals, affected people may also need to be informed.
Do not delay technical containment while waiting for every fact, but avoid speculative statements to customers or staff. Clear, accurate communications protect trust better than reassurance that later proves incorrect.
Build a recovery plan before the next attack
The most reliable ransomware response is prepared well before a ransom note appears. That means maintaining backups that are protected from normal administrator access, retaining copies offsite or in immutable storage, and testing restoration rather than simply checking that backup jobs completed.
It also means knowing who can authorise emergency spend, who contacts your IT provider and insurer, where key phone numbers are stored if email is unavailable, and which systems must be recovered first. A plan that only exists in a shared drive is of limited use when the shared drive is encrypted.
Technical controls matter too. Multi-factor authentication, prompt patching, least-privilege access, monitored endpoint protection and phishing awareness all reduce the chance of an initial compromise becoming a business-wide outage. None is a complete guarantee, but together they make attacks harder to launch and easier to contain.
For SMEs without a dedicated security team, a managed IT partner can provide the monitoring, backup checks and recovery expertise that are difficult to maintain internally. The value is not simply having someone to call during an incident. It is having recovery arrangements that have been designed around how your business actually works.
A ransomware recovery plan earns its value on an ordinary day, when it is tested, corrected and understood. Make time to run a recovery exercise with the people who would be responsible in a real incident. The best moment to discover a missing backup, unclear decision maker or unprotected administrator account is before your business is under pressure.
