Incident checklist
If you think ransomware is spreading, disconnect the affected computers from the network now, but do not wipe them, and do not shut them down unless you cannot disconnect them. Then protect your backups, call your cyber insurance carrier and your IT provider, and write down everything you see. For help right now, call Velocity at 602-445-9816, 24/7.
By the Velocity Technologies team · Last updated October 2026
Speed matters, but so does keeping evidence and backups intact. Work through these in order.
Unplug network cables and turn off Wi-Fi on any machine showing ransom notes or renamed files. If many machines are affected, disconnect the switch or the internet connection. CISA advises powering down only when a device cannot be disconnected, because shutting down erases evidence in memory.
Disconnect backup drives and NAS devices, and change the passwords on backup consoles and cloud backup accounts from a clean device. Attackers look for backups early.
Many policies require prompt notice and assign a breach coach or forensic firm. Hiring help the carrier did not approve can affect coverage.
Velocity answers 24/7 at 602-445-9816. Use a phone, not company email, which may be compromised.
Record what you saw, when, on which machines, and every action taken. Photograph ransom notes. Do not delete anything.
Leave any contact or payment decision to leadership, legal counsel and your insurer.
Some notices are legal duties and some are practical. Your attorney decides what applies.
CISA recommends reporting to CISA at cisa.gov/report, the FBI’s Internet Crime Complaint Center at ic3.gov, or your local FBI field office. The FBI Phoenix field office covers Arizona.
If personal information was accessed, A.R.S. 18-552 requires notice to affected people within 45 days of determining a breach occurred. Above 1,000 people, you must also notify the Attorney General, the Arizona Department of Homeland Security and the three largest credit reporting agencies.
Healthcare practices have HIPAA breach notification duties. Tax preparers covered by the FTC Safeguards Rule must report breaches affecting 500 or more people to the FTC.
Contracts may require notice to customers, prime contractors or vendors within a set time. Check before that clock runs out.
Bring back sign-in first (Microsoft 365 or Active Directory), then the systems that earn revenue, then file shares and everything else.
Rebuild or reimage infected machines. Restoring data onto a compromised system invites a second attack.
Reset every admin and user password, revoke active sessions and re-enroll MFA. Assume anything typed on an infected machine is known to the attacker.
Confirm restored data predates the infection and scan it. Attackers often sit in a network for days before they encrypt anything.
Find out how the attacker got in, whether through a stolen password, a phishing email or an exposed remote access system, and close it.
Including admin accounts, remote access, email and backup consoles.
At least one copy that ransomware cannot reach or change, with separate credentials and scheduled test restores.
Our security team works with a 24/7 security operations center that watches endpoint and email alerts overnight and on weekends, when many attacks start.
FAQ
That decision belongs to leadership, legal counsel and your insurer, not IT alone. The FBI does not encourage paying, and payments to sanctioned groups can violate U.S. Treasury OFAC rules. On the technical side, focus on containment and on proving whether backups can restore.
Yes. Ransomware groups go after backup servers, NAS devices and backup admin accounts. That is why one copy should be offline or immutable, with separate credentials.
Not if you can disconnect them instead. Unplugging the network keeps evidence in memory that a forensic team may need. Power down only if you cannot isolate the device another way.
Yes. We help contain the attack, work with your insurer’s forensic team, restore systems in order and harden the environment afterward. Call 602-445-9816 at any hour.
24/7 help desk
Our help desk answers 24/7 at +1-602-445-9816. Once systems are contained, the free network assessment helps plan the recovery and close the gaps that let the attack in.
