If you are dealing with an attack right now
- Disconnect affected devices from the network by unplugging the network cable and turning off Wi-Fi. Leave them powered on unless your IT provider tells you otherwise, because memory can hold useful evidence.
- Protect your backups. Disconnect any backup drives or devices that are still attached to the network.
- Call your IT provider and, if you have it, your cyber insurer's incident line.
- Do not wipe or rebuild anything yet, and do not contact the attackers.
- Start a written log of what was seen, when and by whom.
The first day: contain and assess
Once the spread is stopped, the priorities are to work out which systems and data are affected, how the attackers got in, and whether data was copied out as well as encrypted. Many ransomware groups now steal data before encrypting it, which changes your reporting obligations even if you can restore everything. Reset passwords for affected accounts and any administrator accounts, starting with Microsoft 365 and remote access.
Who to contact on the Isle of Man
- Isle of Man Constabulary, to report the crime.
- The Cyber Security Centre for the Isle of Man, run by the Government's Office of Cyber-Security and Information Assurance (OCSIA), for guidance and support.
- The Isle of Man Information Commissioner, if personal data may have been accessed, lost or made unavailable. Where reporting is required, it must normally be done within 72 hours of becoming aware of the breach.
- The Isle of Man Financial Services Authority, if you are a regulated business, since it expects prompt notification of serious incidents.
- The Gambling Supervision Commission, if you hold an online gambling licence: check your licence conditions.
- Your insurer, legal adviser and key clients, as your contracts and policy require.
Should you pay?
Paying does not guarantee you get your data back, does not stop stolen data being published, marks you as a business that pays, and may break sanctions rules depending on who the attackers are. Treat payment as a last resort, to be discussed only with your insurer, legal advisers and specialist responders, never directly with the attackers.
Recovering safely
- Restore from clean backups, checking that the backups themselves are not infected.
- Rebuild compromised machines rather than cleaning them where possible.
- Close the way the attackers got in before reconnecting anything.
- Bring systems back in order of business priority, and monitor closely for signs the attackers are still present.
Preparing before it happens
- Keep at least one backup offline or immutable, and test restores.
- Turn on multi-factor authentication for every account that supports it.
- Keep systems patched and retire unsupported software.
- Use endpoint protection with monitoring. See SIEM and MDR explained.
- Write down who to call and keep the list somewhere that does not depend on your network.
Common questions
Can we just restore from backup and carry on?
Only once you know how the attackers got in and whether they took data. Otherwise you risk being attacked again or missing a reporting obligation.
Does cyber insurance cover ransomware?
Many policies do, but terms vary. Check yours now, including any requirements such as multi-factor authentication and backups, because claims can depend on them.
Help when you need it
If your business is under attack, contact Omega IT immediately. To prepare in advance, see our cyber security services or book a free IT Discovery Session.