5 Essential Steps to Take After a Ransomware Attack

Worried how to recover from ransomware or a potential ransomware attack? We have elaborated 5 essential steps to follow to reduce the impact of the attack.


To learn more about phishing scams, read our in-depth blog posts,

Ransomware attacks are like an epidemic. You aren’t sure when, where or how it began and you wake up when it’s already too late.

The best strategy to deal with a ransomware attack is amazingly simple but hard to follow - DON’T PANIC.

Here are 5 actionable steps you can take once you have realized that you are under attack.

Step 1: Disable the Sync Client

Does your company use a Sync client to access your Drive files offline?

If you do, immediately disable the sync client as this acts as a direct pathway to infect your Drive files.

Are you wondering how a sync client would put your Drive in danger?

A sync client offers a two-way synchronization of your Drive files with laptops and smartphones in real-time.

If ransomware encrypts a Drive file on your local system, the synced copy of the file in the Drive will also be infected. Once your Drive is infected, ransomware can easily spread to other folders and Drives through Shared Drives and common folders.

As a G Suite admin, you can turn off the Sync feature from the Admin Console to prevent users from installing the sync client and also to disconnect existing sync.

To disable backup and sync go to Admin console - Apps - G Suite - Drive and Docs - Features and applications - Drive - and select “Do not allow Backup and Sync in your organization”.

Step 2: Disconnect the internet to the infected system

Ransomware cannot get to the cloud from an infected system or spread to other systems without the internet. Disabling it will ensure that the infection doesn’t spread to more computers and Drives.

For example, every organization has common internet servers that connect all the systems. If one system was compromised, the ransomware can spread to adjacent systems through these connected servers. Worst-case scenario, what if all these systems also have an actively running backup and sync client? This would spread the ransomware across different Drives and further opens up the possibility of it spreading to other devices that the infected Drive is in sync with.

Step 3: Notify the authorities

To file a complaint to the FBI Internet Crime Complaint Center, click on the link given in the description.

Step 4: Make sure you are GDPR compliant

If you have customers in the European Union, you would know that GDPR compliance is mandatory. GDPR requires you to inform the Information Commissioner's Office within 72 hours of a breach.

If you don’t comply, you could be fined up to 20 million pounds (That’s about 26 million US Dollars!) or around 4% of annual global turnover whichever is the highest.

That’s something you can’t afford in the midst of an ongoing ransomware attack!

Click on the link in the description to report a breach to the European Information Commissioner's office.

Step 5: Get an effective backup solution for any future attacks

So, what if despite all the security measures, your Google Drive is infected with ransomware?

Disabling the Backup and Sync from the admin account takes around 24 hours to take effect, by this time the ransomware could spread far and wide.

This is where a secure backup solution like SysCloud can come to your rescue.

SysCloud keeps a copy of all your data on the cloud. So in the event of a ransomware attack, you can simply remove the infected files from the Drive and replace it with a previously backed-up version of the file.

In the case of SysCloud, backup files are stored in Amazon Web Services and therefore are safe even if your Drive is compromised.

Let’s summarize all the five steps again:
Immediately disable the sync client
Disconnect internet to the infected system
Request assistance from law enforcement
Comply with GDPR
Keep data backups for future security

Before we sign off, here is a bonus tip!

Did you know that ransomware attacks use email phishing as a vector to infect your systems? If you are adequately protected against phishing attacks, you can keep ransomware at bay.

[Aly_._]

Plz guide me ...
Ransomware attack my system ...
Now i have reinstall and delete all my data also do partitions of my hard drive..
Can i connect to Internet now for my future use or what should i do....

[ianblok]

Why did this get recommended to me
it has 500 views