A ransomware attack: what to do in the first hour, and who to tell

The steps below follow the advice of An Garda Síochána and Europol, the National Cyber Security Centre's (NCSC) account of how an attack spreads, and the GDPR's duties for a business that holds personal data. The NCSC publishes no first-hour checklist of its own, so the order is ours; each step's source is in the section that explains it.

Europol's advice for an infected device begins with disconnecting it from the internet and from any other network connection, Wi-Fi included, as soon as possible, to prevent the infection from spreading.

The NCSC's ransomware guide, which lists Europol's advice among its resources, describes what the attacker is doing at that point: pushing the encryption out to as many devices as possible, and going after the backups it can reach, to prevent recovery. A backup drive that is still plugged in is within reach.

The NCSC adds that before encrypting anything, the attacker will likely have stolen sensitive and personal data, to demand a further payment for not leaking or selling it. It calls this double extortion. Disconnecting stops the spread; it does not bring back a copy already taken.

The Garda advice is not to engage with the criminals or pay any ransom. It gives three reasons: there is no guarantee your data will be released, you could find yourself receiving more demands after a first payment, and paying is no guarantee they will not post your data online anyway, leaving you to have funded organised crime.

Europol's advice is the same: do not pay the ransom, because you would be financing criminals and encouraging them to continue. No More Ransom, the project of Europol's European Cybercrime Centre and the Netherlands police with Kaspersky and McAfee, adds that bugs in the malware can leave the data unrecoverable even with the right key.

Note the time the attack was found and who found it, which devices and systems are affected, and what the screens and the ransom note say, with photographs. You will need it for the report to the Gardaí. If personal data was involved, the GDPR requires the breach to be documented: its facts, its effects and the remedial action taken (Article 33(5)).

Write down, too, when you first knew that personal data was affected. The GDPR's period for notifying runs from when you became aware.

The Garda advice is to report a ransomware attack at your local Garda station. The NCSC's guide says the same, because ransomware is a crime, and adds that ransomware incidents may also be reported to the NCSC at incident@ncsc.gov.ie. The NCSC's incident reporting page says the team that responds to incidents serves government organisations and critical national infrastructure providers, and that the support it gives depends on the incident and the resources available.

Significant or complex attacks on computer systems and corporate networks are investigated by the Garda National Cyber Crime Bureau, which has regional offices in Cork, Galway, Mullingar and Wexford to provide a local response to cyber incidents.

Reporting can be a legal duty as well. Section 19 of the Criminal Justice Act 2011 makes it an offence to fail, without reasonable excuse, to give a member of the Garda Síochána, as soon as it is practicable, information you know or believe might be of material assistance in preventing a relevant offence or in securing the apprehension, prosecution or conviction of someone for one. The relevant offences include the offences in sections 2 to 6 of the Criminal Justice (Offences Relating to Information Systems) Act 2017, in so far as they relate to data, among them intentionally rendering data on an information system inaccessible without lawful authority (section 4). The Garda National Cyber Crime Bureau's prevention booklet describes section 19 as a mandatory reporting provision for relevant offences, which include the cybercrime offences of hacking and data interference.

No More Ransom keeps a repository of keys and applications that decrypt data locked by some types of ransomware, free to use. The Garda advice points to it, and Europol's advice is to always check it for the ransomware variants that have free decryption tools. Its Crypto Sheriff tool helps identify the type of ransomware, to check whether a decryption solution exists.

Not every type of ransomware has one. The site's advice is to keep checking, as new keys and applications are added.

The GDPR defines a personal data breach as a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data (Article 4(12)).

If it is a breach, three duties follow. Notify the Data Protection Commission without undue delay and, where feasible, not later than 72 hours after becoming aware of it, unless the breach is unlikely to result in a risk to people's rights and freedoms (Article 33(1)). Tell the people affected without undue delay where it is likely to result in a high risk to them (Article 34(1)). And document it, including a breach you decide not to notify (Article 33(5)). The first 72 hours of a breach sets out when the clock starts, how to decide, and what the notification must contain.

Europol's advice for the device itself is to format its hard drive, reinstall the operating system and apps, run any available updates, and restore the locked files from your backup. Make the record above first, since formatting removes what was on the device.

The NCSC's backup rule is three copies, on two separate systems, with one offline. What makes a backup count covers keeping a copy out of an attacker's reach, the European Data Protection Board's ransomware cases, and testing a restore before you need one.

The NCSC names three ways attackers get in: phishing, stolen or guessed credentials, and vulnerabilities in systems exposed to the internet, such as remote access, email servers and firewalls. Its priority actions follow from that: keep what is exposed to the internet to a minimum and patched, turn on multi-factor authentication for all remote access and privileged accounts, using an authenticator app in place of SMS where possible, log and monitor, keep backups to the 3-2-1 rule, train staff, and have a plan with the key actions and the people to contact, and test it.

If the attack started with a click on an email, what to do after a phishing click covers the account. What meeting cyber insurance requirements costs covers the controls an insurer asks about.