What to Do If Ransomware Hits Your Business: A Step-by-Step Recovery Guide for UK Businesses

It’s a scenario no business wants to imagine — one morning, you log in to find your files locked, your systems frozen, and a flashing message demanding payment in cryptocurrency.

Ransomware attacks are no longer rare incidents; they are one of the most common cyber threats facing UK organisations today. Whether you run a small business or a large enterprise, a single ransomware event can halt operations, damage your reputation, and cost thousands of pounds in downtime and recovery.

But there’s good news, how you respond in the first few hours can make all the difference. Here’s a clear, practical guide on what to do if ransomware ever hits your business, and how to come out stronger on the other side.

Step 1: Stay Calm and Contain the Damage

The first reaction for most teams is panic, but quick, unplanned actions can make things worse. Start by isolating the infected systems and reviewing your IT infrastructure and network segmentation to ensure the attack cannot spread further. Disconnect affected devices from your network and turn off shared drives, Wi-Fi, and cloud sync tools. The goal is to stop the malware from spreading to other machines or servers.

If you have a managed IT or cybersecurity partner, contact them right away. In the early stages, containment is more important than removal.

Step 2: Identify What You’re Dealing With

Not all ransomware is the same. Some variants only encrypt local files, while others spread across networks or steal data before locking it. Work with your IT or security team to assess the infection through a structured cyber risk assessment, identifying affected systems, at-risk data, and the status of backups. 

Understanding the type and scope of the ransomware helps you decide the next steps and avoid paying for fake decryption tools circulating online.

Step 3: Report the Incident

In the UK, ransomware attacks should be reported to:

• The National Cyber Security Centre (NCSC) – for official guidance and threat tracking.
• The Information Commissioner’s Office (ICO) – if personal or customer data is affected, under GDPR requirements.
• Law enforcement (Action Fraud) – to record the crime and assist in potential investigations.

Reporting isn’t just about compliance — it helps protect other businesses and ensures your organisation follows the right legal process if data is compromised.

Step 4: Restore Systems Safely

If you have verified offline backups, now is the time to use them — but carefully. Before restoring, ensure the ransomware has been fully removed. Scan your systems with trusted security tools and check that restored files are clean.

Never restore from backups that were connected to the network during the attack — they may be infected too.

Once clean systems are up and running, monitor activity closely for several days to ensure there’s no lingering threat.

Step 5: Review, Learn, and Strengthen Defences

A ransomware attack is a wake-up call — but it can also be a turning point. After recovery, take time to review how the attack happened and where your defences failed. Common weak points include:

• Outdated operating systems or software patches
• Poor password or access control policies
• Lack of employee awareness about phishing
• Missing or untested backup routines

Implement stronger endpoint protection, multi-factor authentication, and a regular cybersecurity awareness programme for staff.

If you don’t already have one, create a Ransomware Response Plan — a step-by-step playbook for next time, so you can act fast and smart.

Step 6: Don’t Pay the Ransom

Paying might seem like the quickest fix, but it rarely ends well. There’s no guarantee you’ll get your data back — and in many cases, it marks your business as a soft target for future attacks. Instead, focus on restoring from backups and reinforcing your systems. Prevention and preparedness are always cheaper than paying criminals.

Building Cyber Resilience with Gradeon

At Gradeon, we help UK businesses prepare, protect, and recover from cyber incidents through structured governance, compliance, and security frameworks.
From building secure cloud infrastructure to implementing effective incident response and recovery plans, our team ensures your business stays resilient — no matter what threats emerge.

If your organisation wants to assess its ransomware readiness or strengthen its defences, our experts are here to help.

👉 Stay ready, stay secure, and never let ransomware hold your business hostage.