What to do before anyone arrives
Unplug the network cable or turn off the wifi on affected machines, but leave them powered on. Shutting down can lose recoverable material held in memory, and rebooting can trigger further encryption.
Do not delete the ransom note, do not start reformatting, and do not pay anything yet. Tell staff to stop using shared drives until somebody has looked, because that is how it reaches the server.
What recovery actually looks like
First containment, so it stops spreading. Then working out what was encrypted, which systems were touched, and whether data left the building, because that last one changes your obligations, not just your inconvenience.
Then restoration, which depends entirely on whether you have backups that the ransomware could not reach. If you do, this is a bad week. If your backup was a drive plugged into the same network, it is usually encrypted too.
Being straight about outcomes
Sometimes there is no clean recovery. If backups were never working and the encryption is done properly, no local IT company can decrypt it, and anyone who tells you otherwise is selling something.
We will tell you where you actually stand, including when the honest answer is that the data is gone and the fastest path is rebuilding. Then we close the door that was used, because the same one gets tried again.
What we actually do
Containment first
Stop the spread before anything else. Most of the damage we see happened after the first machine, while people kept working.
Assessment
What was encrypted, which accounts were used, how it got in, and whether data was taken as well as locked.
Restore from backup
Where usable backups exist, restore and verify. Where they were reachable by the attacker, we say so plainly.
Rebuild
Compromised machines get rebuilt, not cleaned. A cleaned machine you are not sure about is a machine you cannot trust.
Close the entry point
Exposed remote desktop, a reused password, an old account nobody disabled. Fixed, or it happens again.
Backups that survive next time
Offline or immutable copies, tested by restoring from them, not by checking that a job says success.
Frequently asked
Should I pay the ransom?
That is your decision and it has legal and practical risk. Payment does not guarantee a working decryptor, it marks you as a business that pays, and in some cases paying a sanctioned group is itself illegal. We will lay out what we know about your specific situation and what your realistic alternatives are before you decide.
Can you decrypt my files?
Usually not directly. Modern ransomware is properly implemented and cannot be brute forced. Occasionally a known family has a public decryptor and we check that first. Recovery almost always comes from backups instead.
My backup drive was plugged in. Is it gone?
Probably encrypted too, and that is the most common way recovery fails. Anything reachable from an infected machine is at risk, which is why an offline or immutable copy matters more than backup frequency.
Do I have to tell anyone this happened?
Possibly. Texas has breach notification requirements, and if data was taken rather than only encrypted, obligations may apply depending on what it was. We are not attorneys and will tell you when you need one rather than guess.
How long until we are working again?
With tested backups and a contained incident, often days. Without them it depends on what has to be rebuilt from nothing. We will give you an honest estimate once we can see the scope, not before.
How did they get in?
Most often exposed remote desktop, a password reused from a breach elsewhere, or an account that belonged to someone who left. Finding out is part of the job, because otherwise you are just waiting for it again.
Serving the Coastal Bend
Alice, Corpus Christi, Kingsville, Beeville, Robstown, Sinton, Mathis, Orange Grove, Premont, Falfurrias, George West, Three Rivers, and the towns between them. On-site where it matters, remote where it does not.