What "ransomware support" actually means
It means different things depending on the hour. At 2 a.m. on the day your files get encrypted, it means a phone number that someone answers. Three weeks later, it means people who can rebuild your systems and tell you what the attackers touched. Six months before, it means the boring preparation that decides how bad the whole thing gets.
Most small and mid-sized businesses only think about it at the first stage, when it's already too late to shop around. This post is about lining up the help before you need it.
The first hour
Cut the affected machines off from the network. Unplug the cable, turn off Wi-Fi, or disable the switch port. Don't wipe anything, and don't start "cleaning up."
Leave the machines powered on if you can. Memory sometimes holds encryption keys or traces of the attacker, and a shutdown destroys them. The exception is when encryption is visibly spreading and you can't isolate it. Then power off and accept the loss.
Next, write down what you see: the ransom note, the file extension on the encrypted files, the time you noticed. Photograph the screen with your phone. Those details help identify the strain.
Then make calls, in this order:
- Your cyber insurance carrier, if you have one. Most policies require notice within a short window, often 24 to 72 hours, and some limit coverage if you hire your own responders first.
- Your incident response firm or IT provider.
- A lawyer, ideally one who handles breaches.
- Law enforcement. In the US, that's the FBI's Internet Crime Complaint Center (ic3.gov) or your local FBI field office. CISA also takes reports.
Don't email the attackers or open their chat portal yet. Anything you say can come back to bite you.
Free help that's worth using
Two resources are legitimate and free.
ID Ransomware (id-ransomware.malwarehunterteam.com) lets you upload a ransom note or a sample encrypted file and tells you which strain you probably have. That matters because some strains have known flaws, and some are impossible to crack.
No More Ransom (nomoreransom.org) is a joint project of Europol, the Dutch police, and security vendors. It hosts free decryptors for dozens of older strains. If yours is on the list, you may recover files without paying anyone.
Be realistic, though. Free decryptors exist for a minority of cases, and the big current operations mostly aren't among them. Check, because it takes ten minutes, but don't plan around it.
Paid support: what you're buying
A real incident response firm does four things:
- Containment. They find how the attacker got in and shut it. If you restore before this step, you often get hit again within days.
- Forensics. They work out what was accessed and whether data was stolen. This drives your legal notification duties.
- Recovery. They help rebuild systems in a safe order, usually domain controllers and identity first.
- Negotiation, if it comes to that. Some firms handle it. Others hand it to a specialist.
Rates are a rule of thumb that shifts by region and firm: roughly $300 to $600 an hour for responders. A small-business incident commonly runs into the tens of thousands of dollars. A larger one reaches six or seven figures. Those are ballpark figures from my experience of quotes, not from a published survey.
Retainer or no retainer
A retainer is a contract that guarantees a response time, often within an hour or two, with a block of prepaid hours (commonly 20 to 40). Some firms attach it to a monitoring service. Some insurers bundle one.
My pick for a business under about 200 employees is simple. Buy a cyber policy that includes a pre-approved response panel and a breach coach (a lawyer who runs the first calls), and skip the standalone retainer. The panel firms already have rates negotiated with the insurer, and the insurer pays them. A separate retainer on top mostly means paying for the same hours twice.
A standalone retainer makes sense in two cases: you're too large or too odd to insure well, or your policy lets you pick your own vendor and you already trust one. Otherwise it's money you'd rather spend on backups.
Insurance premiums vary a lot with revenue, industry, and your controls. As a rough guide, a small business buying $1 million in coverage might pay somewhere between $1,500 and $5,000 a year. Insurers will increasingly refuse to quote at all without multi-factor authentication on email and remote access. Get a few quotes, because the spread is wide.
The question of paying
Don't make this decision alone and don't make it on day one.
Paying carries real risks. The decryptor might be slow or partly broken, and you can't count on getting every file back. You may also be paying a sanctioned group, which creates legal exposure in the US under Treasury Department sanctions rules. A lawyer and your response firm should check that before a cent moves.
Paying also doesn't settle the data theft question. Many groups now steal files before encrypting them. A payment for "deletion" is a promise from a criminal.
I wouldn't bother with a standalone "ransomware recovery" outfit that cold-calls you after an attack or promises to decrypt anything for a flat fee. Some are brokers that pay the criminals and add a markup, and they aren't always upfront about it. Stick to firms your insurer, lawyer, or a trusted peer vouches for.
The support that costs the least
Backups are the cheapest ransomware support you can buy, and the only kind that works at 2 a.m. without anyone picking up a phone.
Some numbers you can act on:
- Follow 3-2-1. Three copies, two media types, one offsite. Make one copy immutable or offline, so an attacker with your admin password can't delete it.
- Back up daily for anything that changes daily. Hourly for databases you can't afford to lose a day of.
- Test a restore every quarter. Restore a full server, not a single file, and time it. If it takes four days and you can survive two, you've learned that for free.
- Immutable cloud storage with object lock runs about $6 to $7 per terabyte per month at some of the major low-cost providers as of this writing. Check current pricing. For a business with 5 TB of data, that's under $40 a month, which is a rounding error next to one day of downtime.
Add multi-factor authentication on email, VPN, and every admin account. That one control closes a large share of the doors attackers walk through.
A one-page plan
Write a single page and print it. Keep a copy somewhere that doesn't depend on your network. It should list:
- Your insurer's claims hotline and your policy number
- Your response firm and lawyer, with after-hours numbers
- Who has authority to approve spending and shut systems down
- Where the offline backups live and who can reach them
- Your outside IT provider's contact
Then run a 90-minute tabletop exercise once a year. Gather the people on that page, walk through "it's Saturday and every file server is encrypted," and see who doesn't know what to do. You'll find gaps in the first twenty minutes.
The short version
Free tools can identify your strain, and sometimes decrypt it. Insurance with a response panel covers most small businesses better than a retainer. Backups you've tested are better than either.
Get the page written this month.