When a company suspects a ransomware infection, how the first hour is handled often decides whether the loss is contained or catastrophic. Below are the 7 emergency steps Network Star recommends for Hong Kong SME IT or admin staff to use before professional support arrives.

How do you know if your company has ransomware?

Common signs: file extensions changed to unfamiliar formats and files that will not open, a ransom note in every folder (usually .txt or .html), the desktop wallpaper replaced, sudden severe slowdowns, and antivirus being disabled. If several computers show these signs at once, ransomware is very likely spreading across the network.

The 7 emergency steps after infection

  1. Isolate affected devices: unplug the network cable and turn off Wi-Fi immediately, but do not shut down — data in memory can help with investigation and possible decryption.
  2. Cut off the spread: suspend file server shares, disable suspicious accounts, and if necessary temporarily disconnect the external network.
  3. Preserve evidence: photograph the ransom note, encrypted files and error messages, and record when the problem was found and which computer was hit first.
  4. Notify internally and get professional help: inform management and contact your IT service provider or an incident response team so efforts are coordinated.
  5. Check backup status: confirm whether an offline or off-site backup is unencrypted — never reconnect backups to an infected network before the malware is removed.
  6. Do not rush to pay the ransom: payment does not guarantee recovery, may breach regulations and encourages further attacks. Assess what your backups can restore first.
  7. Wipe and rebuild: infected computers should be reimaged, not just scanned. Confirm the entry point (usually phishing email, exposed remote desktop, or an unpatched vulnerability) is closed before restoring data step by step.

Should you report it to the police or a regulator?

Hong Kong companies can report to the Hong Kong Police Force Cyber Security and Technology Crime Bureau, and contact the Hong Kong Computer Emergency Response Team Coordination Centre (HKCERT) for technical coordination. If personal data is exposed, assess whether the Office of the Privacy Commissioner for Personal Data and affected individuals must be notified under the Personal Data (Privacy) Ordinance.

How to prevent it happening again

  • Use a 3-2-1 backup strategy — 3 copies, 2 media types, 1 offline or off-site — and test restores regularly.
  • Enable multi-factor authentication (MFA) for all remote access and administrator accounts.
  • Close unnecessary external RDP ports and use a VPN instead.
  • Patch operating systems and software promptly and retire end-of-life systems.
  • Deploy endpoint detection and response (EDR) and train staff to spot phishing emails.

Network Star provides backup and disaster recovery, network security hardening and IT outsourcing and managed services to help businesses build defences before an incident and recover quickly after one.