My Network Was Just Hacked With Ransomware. What Should I Do?

Modified on: Thu, 27 Oct, 2022 at 8:58 AM

Find the RJ45 Ethernet plug in back of the computer and disconnect the plug
1. If a wireless connect, right click the wireless icon in system tray and choose to disconnect, then disable the wireless adapter
Call someone in IT or knowledgeable person who can help
- Who can you call for help in Ohio? First line of help is
  1. Terin D Williams - This security advisor can walk you through the steps on mitigating the attack but is not allow to access your network (only State agencies)
    Cyber Security Advisor for the State of Ohio
    Terin.Williams@cisa.dhs.gov
    614-314-7793
  2. The Ohio Cyber Reserve has a volunteer staff that can also assist with Cyber breaches, but they may take a day or two before responding
    https://www.ong.ohio.gov/special-units/cyber/ohcr/index.html
    Craig W Baker
    craig.w.baker2.nfg@marmy.mil
Leave your computer running
1. Some tools can find the encryption key if the computer is still running
If you have a backup appliance or back up hard drive, remove it from the network and/or machine to ensure it is safe
Check other systems on the same subnet, if in doubt, unplug systems from the subnet/ switch
Capture a screen shot of the ransomware notice. Do not turn off machine.
Find the name of the ransomware from your screenshot
Some Keys are available for Ransomware, contact your local FBI or here: https://www.ic3.gov/Home/FileComplaint
Call SEO Service Center to inform us so we can monitor our database