Ransomware in the Office: What to Do in the First Hour and How Not to Lose Your Data

Ransomware is the most common cause of total data loss in small businesses. Paying the ransom makes no sense — the only thing that saves you is a backup the malware couldn’t reach.

What it looks like

In the morning, the accountant can’t open the 1C database, documents in the shared folder have turned into files with a strange extension, and there’s a text file on the desktop demanding payment in cryptocurrency. Infection usually starts with an email attachment or a brute-forced RDP password on a server exposed to the internet.

The first hour: what to do

1. Disconnect infected computers from the network — pull the cable or turn off Wi-Fi. Ransomware spreads through shared folders, and every minute means more encrypted files.
2. Don’t shut down the server if it’s still running — but disconnect it from the network. Sometimes part of the data is still intact.
3. Don’t pay. The key doesn’t always arrive, and paying makes you a permanent target.
4. Find the latest backup the malware didn’t reach. An external drive connected to an infected computer is most likely encrypted too. A cloud backup is not.
5. Call whoever handles recovery. If you have a backup or administration subscription, message us and we’ll help with the restore.

Recovery

The usual sequence: a clean OS reinstall on infected machines, changing all passwords, restoring the server from an image and files from backups taken before the infection. With 1C backups every 6 hours, you lose at most half a day of work. Without backups — weeks of manual recovery or losing everything.

What should have been done beforehand

• Backups outside the office and outside your network. Malware can’t encrypt what it can’t access. Backups in the data center are stored with version history: even if the infection is discovered three days later, you can roll back to the state from a week ago.
• Locked-down RDP. Terminal access only via VPN or a gateway with two-factor authentication, with login attempt limits. This shuts down most attacks on 1C servers.
• Updates. Most ransomware exploits long-patched vulnerabilities — on computers nobody has updated.
• User permissions. Employees shouldn’t work as administrators; then malware can’t disable protection and reach system files.
• Test restores. Once a month, verify that the database actually restores from the backup. A backup nobody has tested is a lottery ticket.

What we offer

Backup to our data center in Tashkent with encryption and version history, plus — optionally — server administration with RDP protection and update management. Setup is free, and we help with recovery.