A ransomware screen can turn a normal workday into a full-stop emergency. Files will not open, shared folders disappear, and a message demands payment before your team can get back to work. This small business ransomware response guide gives Baltimore-area owners a clear first move: contain the problem before it spreads, then bring in qualified help to protect data and restore operations.
First: Stop the Spread Without Destroying Evidence
Ransomware is not just a locked computer. It is an active security incident that may affect connected laptops, servers, shared drives, cloud storage, backups, and even customer information. The first few minutes matter.
Immediately disconnect the affected computer from the network. Unplug its Ethernet cable and turn off Wi-Fi. If it is a desktop, leave the machine powered on unless it is actively encrypting files and you have been instructed otherwise by a technician. Pulling the power can erase useful clues from memory, but allowing a clearly active encryption process to continue can cause more damage. This is one reason a fast onsite or remote assessment is valuable.
Do not reconnect the device to “see if it works now.” Do not plug in external backup drives. Do not log into shared accounts from the infected system. A single reconnection can give the ransomware another path into files that were still safe.
If multiple computers show strange file names, ransom notes, missing access, or unexplained login alerts, isolate each affected device. Tell employees to stop using company computers and shared folders until the situation is assessed. That may feel disruptive, but a short pause is often far less costly than encrypting every workstation in the office.
Preserve What Happened
Before anyone starts deleting files or reinstalling Windows, document the incident. Take photos of the ransom note, error messages, changed file extensions, and any suspicious emails or pop-ups. Write down when employees first noticed the issue, which systems were affected, and whether anyone clicked a link, opened an attachment, or entered credentials after an unexpected prompt.
Keep the ransom note and any attacker contact information. Do not communicate with the criminals until you understand what was encrypted, what backups exist, and whether data may have been copied out. Modern ransomware groups often use double extortion: they encrypt files and threaten to publish stolen information if the victim does not pay.
Your technician or cybersecurity provider will need practical details, including your backup system, cloud applications, network equipment, antivirus tools, administrator accounts, and the names of anyone with access to financial or customer records. You do not need to become an investigator overnight. You do need to avoid changing everything blindly before the incident can be evaluated.
Do Not Pay in a Panic
A ransom demand is designed to create urgency and fear. Paying may seem like the fastest way to get back to work, but it comes with serious trade-offs. There is no guarantee the attacker will provide a working decryption key, remove stolen data, or leave your network alone afterward. Payment can also create legal and insurance complications depending on who received the money and what information was involved.
For some businesses, especially those without usable backups and with critical systems offline, the decision may involve insurers, legal counsel, incident-response specialists, and law enforcement. That decision should be made with facts, not under pressure from a countdown timer on a ransom screen.
Check Backups From a Clean Device
Good backups are your best leverage in a ransomware event, but only if they are intact and clean. Never connect a backup drive to a computer you suspect is infected. Use a known-clean computer or have an IT professional verify the backup environment first.
Look for the most recent backup from before the attack. Confirm that it contains real, usable files rather than only a successful-looking status message. A backup that has been silently failing for months will not help when payroll records, QuickBooks files, project folders, or customer documents are locked.
Cloud storage can help, but it is not automatically a complete backup. If ransomware encrypted synced folders, the encrypted versions may have synchronized to the cloud as well. Version history and recycle-bin recovery may save some files, depending on the platform and retention settings. Check carefully before restoring anything.
The safest approach is usually to rebuild or clean affected systems first, then restore verified data from a backup created before the compromise. Restoring data onto an infected computer can put you right back at the beginning.
Reset Access Before Resuming Work
Ransomware often begins with stolen passwords, weak remote access settings, phishing, or unpatched software. Removing the visible ransom note does not close the door the attacker used.
From a clean device, change passwords for business email, Microsoft 365 or Google accounts, remote desktop tools, VPN access, accounting platforms, banking portals, and any administrator accounts. Start with the highest-privilege accounts. Require multi-factor authentication wherever it is available, especially for email and remote access.
Review user accounts and forwarding rules in email. Attackers commonly add mailbox rules to hide security alerts or copy messages. Check for unfamiliar users, unexpected password-reset requests, new remote-access software, and login activity from unusual locations.
If your office uses a shared Wi-Fi password, change it. If network equipment has default or old administrator credentials, change those too. In a small office, the router is often overlooked even though it controls the front door to the network.
Decide Who Needs to Know
Your employees need clear instructions, not rumors. Let them know what systems they can and cannot use, where to report suspicious activity, and how to continue essential work safely. If business email is affected, use a verified alternate communication method rather than sending updates from a potentially compromised account.
You may also need to notify customers, vendors, your cyber insurance carrier, or regulators. The right response depends on whether sensitive data was accessed or stolen, the type of information involved, your contracts, and applicable state or federal requirements. Encryption alone is not always proof of a data breach, but it should be treated as a serious possibility until the investigation says otherwise.
If you carry cyber insurance, contact the carrier early. Many policies require use of approved incident-response vendors and may have specific reporting deadlines. Calling after you have already wiped systems, paid a ransom, or hired outside help can make coverage harder to use.
Get the Office Back Online in the Right Order
Restoration should be deliberate. Start with the systems that keep the business operating: internet and firewall equipment, a clean file-sharing environment, email access, point-of-sale or scheduling tools, and the workstations used by key staff. Not every computer has to be restored at once.
A qualified technician should identify the ransomware strain when possible, check for signs of persistence, remove unauthorized remote access, patch the operating system and applications, and verify that endpoint protection is installed and current. In some cases, a full rebuild is safer and faster than trying to clean a badly compromised computer file by file.
Test restored files before declaring the crisis over. Open accounting data, customer records, images, spreadsheets, and databases. Make sure permissions work correctly and that no encrypted files are being copied back into live folders. Monitor systems closely for unusual activity after restoration.
Atomic Geeks can provide fast onsite or remote support for small businesses across Baltimore and surrounding Maryland counties when ransomware, malware, network trouble, or data recovery needs immediate attention.
Prevent the Next Attack While the Lesson Is Fresh
The best time to improve security is right after an incident, when the weak points are obvious. That does not mean buying every security product available. For most small businesses, a practical plan is better: protected backups, multi-factor authentication, patched computers, secure remote access, current antivirus or endpoint protection, and staff who know how to spot suspicious emails.
Use the 3-2-1 backup principle where it makes sense: keep three copies of important data, on two different types of storage, with one copy offline or otherwise protected from the main network. Test restoration regularly. A backup is only trustworthy when you have successfully recovered from it.
Create a simple written response plan with contact names, insurance details, backup locations, software account information, and a short list of who can authorize major decisions. Keep a copy available outside the main network. When a ransomware message appears, nobody should be hunting through an encrypted shared drive for the plan.
If your business is staring at locked files right now, focus on the next safe action, not the attacker’s deadline. Isolate the affected systems, protect your backups, and get experienced help before a single infected computer becomes an office-wide shutdown.
