Ransomware Attack? What to Do First (Singapore SME Guide)

The first hour: what to do right now

1. Disconnect infected computers from all networks: unplug network cables, turn off Wi-Fi, and remove USB drives and Bluetooth devices. The police advisory lists this first.
2. Don't wipe anything yet. If you can, leave affected machines powered on but disconnected, so a responder can examine them later.
3. Check other devices and cloud accounts (shared drives, OneDrive, Google Drive, the NAS) for files being renamed or encrypted, and disconnect them too.
4. Photograph the ransom note and write down the time you noticed, what you saw and who was using the machine.
5. Call your key people: the owner or director, whoever looks after IT, and your cyber insurer if you have one (insurers often require early notice and may provide a response team).
6. Don't contact the attackers or click anything in the ransom note.
7. Lodge a police report online. The police advisory says SingCERT is notified when you do.

Should you pay the ransom?

The Singapore Police Force's ransomware advisory says ransom payments are strongly discouraged, because:

• there is no guarantee that paying will get your files decrypted, or that the criminals won't publish your data anyway;
• it encourages criminals to keep attacking and to target more victims;
• your organisation may be seen as a soft target and attacked again.

The advisory also says that if you have already paid and your files are still encrypted, you should report it to the police, and report any data breach to the PDPC.

Who to report to, and when

The police advisory reminds organisations that a breach likely to cause significant harm, or affecting 500 or more individuals, must be notified to the PDPC. Our guide to the PDPA data breach notification rules explains how to assess this.

Recovering safely

The police advisory sets out the recovery steps for an infected computer:

1. Scan and clean the computer with antivirus or anti-malware tools, or better, wipe and reinstall it.
2. Check the No More Ransom project for a free decryption tool for the type of ransomware you have.
3. Restore your data from backups, onto a clean installation that is completely free of the malware. The advisory warns that most ransomware leaves something behind that can re-encrypt data if not fully removed.

Then close the door the attackers used:

• Change every password, starting with admin accounts, email, remote access and backups, and sign out all sessions.
• Turn on MFA for every internet-facing service, especially email and remote access.
• Patch the software that was exploited, and update everything else while you're at it.
• Check for leftover access: new admin accounts, remote-access tools you didn't install, forwarding rules in mailboxes.
• Watch for follow-up attacks, including emails to your customers pretending to be you.

If you don't know how the attackers got in, assume they may still have a way in, and get specialist help before reconnecting systems.

If there's no usable backup

This is where ransomware does the most damage. Before deciding anything:

• Check every possible copy: OneDrive or Google Drive version history (OneDrive for work accounts can roll back up to 30 days), old laptops, email attachments, external drives that were unplugged at the time.
• Check No More Ransom for a free decryptor.
• Ask your insurer, if you have cover, what response help is included.
• Talk to a professional incident response provider about what can be recovered.

Our guide to backing up Microsoft 365 and Google Workspace explains how to make sure this never happens again.

How to make ransomware less likely

The police advisory's prevention list is short and practical:

• Back up regularly to a separate system and keep it offline, for example an external drive that is disconnected, or a cloud backup.
• Use strong passphrases and two-factor authentication for all internet-facing services, particularly webmail, VPNs and accounts that access critical systems.
• Be careful what you click: ransomware often starts with a malicious email or link.
• Keep devices and antivirus updated, and download apps and updates only from official sources.
• Consider splitting your network into smaller parts (network segmentation), so ransomware on one machine can't easily spread to the rest.

Add a written plan, so that on the day nobody has to work out who to call. The PDPC's breach guide also recommends periodic exercises or walkthroughs so key people know their roles.

Do it yourself or get help?

During an active attack, if the infection is spreading or you can't tell how far it has got, call a professional incident response provider. IT Sorted is not an on-call incident response team, and we won't pretend to be one.

Where we help is before and after. An Incident & Ransomware Response Plan (S$390) gives you ransomware, hacked-email and lost-device playbooks, a contact sheet (bank, SingCERT, police, insurer), the PDPC 3-day steps and a tabletop exercise pack. Backup & Ransomware Recovery (S$290) sets up off-site backups with a tested restore, and Antivirus & Endpoint Protection Rollout (S$390) puts business-grade protection with ransomware features on every machine.