Well, it’s easier said than done, but the most important thing when following these steps is to remain calm.
1. Do not contact the hackers:  Until they receive confirmation from the victim many hackers don’t know if the organisation has successfully been compromised. As soon as you contact them, you make the organisation more vulnerable to threats, pressure, and the ransom demand increases.
2. Document Evidence: You might want to sprint into action and implement your Business Continuity playbook straight away, but one of the first things you should do is document the evidence for cyber insurance and law enforcement. Take pictures of the Ransomware message and record any other notable information available.
3. Identify and Contain: Before implementing your recovery plan, you must prioritise identifying and isolating any infected systems. This could be achieved by shutting down the network or simply pulling out cables, but each step must be included in your recovery plan.
4. Notify Stakeholders: Once you’ve stopped the infection from spreading further and taken stock of the situation, you’re now in a position to inform the relevant stakeholders – these include law enforcement, insurance, and the companies you do business with about the incident.