Your Business Has Been Hit by Ransomware. Now What? A Ransomware Recovery Plan for NJ Small Businesses

The call usually comes early in the morning. Someone arrived at the office, turned on their computer, and found a note instead of a desktop. Files will not open, the server is unreachable, and the phone system that depends on it is dead. What happens in the next few hours determines whether this is a two-day disruption or a business-ending event, and the single biggest factor is whether a ransomware recovery plan existed before the attack.

This guide, rewritten for 2026 from our original 2022 article, explains what to do in the first hour, the first day, and the first week after a ransomware attack, how to decide about the ransom, who must be notified, and how to build the plan now so you are never improvising.

For the broader incident playbook covering any kind of attack, see our step-by-step guide on what to do after a cyberattack. This article is specific to ransomware, which has its own decisions and its own clock.

How Ransomware Attacks Small Businesses in 2026

Ransomware is no longer a single piece of malware that encrypts a hard drive, and a ransomware recovery plan written for that older threat is out of date. Modern attacks against New Jersey small businesses follow a pattern that shapes every part of a ransomware recovery plan:

• Initial access through a phished or stolen password, an exposed remote desktop port, an unpatched firewall or VPN, or a malicious download. Credential theft is the most common door.
• Quiet reconnaissance over days or weeks, during which the attacker maps the network, finds the backups, and escalates to administrator rights.
• Data theft before encryption. Most groups now copy sensitive files out first, so that even a business with perfect backups can be extorted with the threat of publication. This “double extortion” is why ransomware is almost always a data breach, not just an outage.
• Destruction of backups that the attacker can reach, followed by encryption of servers and workstations, often timed for a weekend or holiday.
• The ransom demand, typically in cryptocurrency, with a deadline and a leak-site countdown.

Understanding that sequence explains the priorities in any ransomware recovery plan: contain fast because the attacker may still be inside, assume data was stolen, and never count on backups the attacker could see.

Ransomware Incident Response Steps: The First Hour

The first hour is about stopping the spread and preserving your options, and it is the section of a ransomware recovery plan that should be printed and posted. These ransomware incident response steps apply whether you have a plan or are reading this in the middle of an attack.

1. Isolate, do not power off. Disconnect affected computers and servers from the network by unplugging the cable or disabling Wi-Fi. Do not shut them down; memory may hold evidence and encryption keys that responders can use. Disconnect any backup drives or NAS devices that are still intact.
2. Call your IT provider or incident response team immediately. If you have a managed service provider with security operations, they may already be responding. If you have cyber insurance, the policy likely names a breach hotline that must be called before other vendors are engaged.
3. Do not communicate with the attackers yet, and do not pay. Those decisions come later, with counsel and insurer involved.
4. Preserve evidence. Photograph the ransom note, record the time, note which systems are affected, and do not wipe or reinstall anything.
5. Change critical credentials from a clean device: administrator accounts, Microsoft 365 global admins, banking, and remote access. Assume every password in the environment is compromised.
6. Start a log. Who did what, when. Insurers, regulators, and law enforcement will ask.

The First Day: Assess, Notify, and Decide

Assess the damage

With responders engaged, the next ransomware incident response steps establish the scope: which systems are encrypted, which are clean, what data lives on the affected systems, whether backups survived, and whether there is evidence of data exfiltration. Identify the ransomware variant from the note and file extensions; some have public decryptors, and all have known behaviors that inform the response. Determine how the attacker got in, because recovery without closing that door invites a second attack.

Notify your cyber insurance carrier

A ransomware recovery plan should have the carrier’s hotline on its first page. Most policies require notice within a short window and give the carrier a say in which forensics firm, law firm, and negotiator are used. Calling late or hiring your own vendors first can jeopardize coverage. The carrier’s panel counsel also establishes privilege over the investigation, which matters if litigation follows. Our cyber insurance coverage guide explains what to expect.

Report to law enforcement

Report the attack to the FBI through the Internet Crime Complaint Center (IC3) and to the New Jersey Cybersecurity and Communications Integration Cell (NJCCIC). Law enforcement rarely recovers data, but reports feed investigations that have taken down ransomware groups, may provide decryption keys when infrastructure is seized, and are expected by insurers and regulators. CISA’s StopRansomware resources include a response checklist that aligns with this article.

Begin the regulatory clock

Because data theft is now the norm, a ransomware recovery plan should treat the attack as a breach until forensics proves otherwise. Under HIPAA, ransomware that encrypts protected health information is presumed to be a breach unless the practice can demonstrate a low probability of compromise, and notification to patients and HHS is due within 60 days. The FTC Safeguards Rule requires notice to the FTC within 30 days for events affecting 500 or more consumers. New Jersey’s breach notification law requires notifying affected residents and the State Police. SEC rules apply to advisors. Counsel will manage these, but the deadlines start at discovery, which is today.

Should You Pay the Ransom?

Every business owner asks this, usually within the first hour, and a good ransomware recovery plan answers it in advance. The question “should you pay the ransom” has no universal answer, but there are facts that should shape the decision, which must be made with your insurer and counsel rather than alone:

• Payment does not guarantee recovery. When clients ask us “should you pay the ransom,” this is the first point we make: Decryptors provided by attackers are often slow, partial, or broken, and some victims who pay never receive a working key.
• Payment does not prevent data publication. Groups that promise to delete stolen data routinely keep it, resell it, or extort the same victim again.
• Payment can be illegal. Paying a group on the U.S. Treasury’s OFAC sanctions list exposes your business to penalties regardless of intent. Professional negotiators check this, which is one reason not to engage attackers yourself.
• Payment marks you as a payer. Businesses that pay are more likely to be attacked again.
• Law enforcement and CISA advise against paying when asked should you pay the ransom, and some insurers are tightening coverage for ransom payments.

The businesses that are never forced into this decision are the ones whose ransomware recovery plan included immutable, offline backups the attacker could not touch and a tested ability to restore from them. That is the whole point of planning ahead.

The First Week: Recover and Rebuild

1. Close the entry point first. Patch the vulnerability, disable the exposed service, reset every credential, and remove any accounts or tools the attacker created. Restoring systems onto a network the attacker can still reach only restarts the attack.
2. Rebuild rather than clean. Wipe and reinstall affected servers and workstations from known-good images. Attempting to clean an infected system leaves hidden persistence behind.
3. Restore from backups in priority order, using the recovery objectives in your plan: the systems the business cannot run without first. Verify restored data is clean and from a point before the intrusion, which may be weeks before the encryption.
4. Enforce MFA and least privilege across the rebuilt environment before users return, and deploy endpoint detection and response if it was not in place.
5. Communicate. Staff, clients, patients, and partners need clear, consistent information approved by counsel. Silence breeds rumor and damages trust more than the incident itself.
6. Monitor closely. Attackers frequently return within days. Heightened monitoring for at least 90 days is standard.
7. Document everything for the insurer, regulators, and your own post-incident review.

Building a Ransomware Recovery Plan Before You Need It

Everything above goes faster, cheaper, and calmer with a written ransomware recovery plan. For a small business the plan is a short document, built on a short set of technical controls.

The technical foundation

• Backups that ransomware cannot reach: the 3-2-1-1-0 approach with at least one immutable or offline copy, retention long enough to reach back past a weeks-long intrusion, and restores tested quarterly. Our backup and disaster recovery guide covers the design.
• Multi-factor authentication on email, remote access, and every administrator account, which blocks the most common entry point. See MFA for small business.
• Endpoint detection and response with 24/7 monitoring, so an intrusion is caught during reconnaissance rather than after encryption.
• No exposed remote desktop, a patched firewall and VPN, and removal of local administrator rights from staff workstations.
• Network segmentation so that one compromised workstation cannot reach every server and backup.
• Security awareness training and phishing simulations, because the first click is still the most common start.

The written plan

• Critical systems ranked with recovery time and recovery point objectives.
• Who declares an incident, who leads, and who has authority to spend money and make the ransom decision.
• Contact list stored offline: IT provider, cyber insurance hotline, breach counsel, forensics, law enforcement, key vendors, and staff.
• The first-hour isolation steps, printed and posted where staff can find them without a computer.
• Manual workarounds so the business can operate during recovery: paper intake, phone trees, alternate email.
• Communication templates for staff, clients, and patients.
• Regulatory notification obligations and deadlines specific to your industry.
• A schedule for tabletop exercises, at least annually.

What Ransomware Actually Costs a Small Business

Owners who have not lived through an attack tend to think of the ransom as the cost. It is usually the smallest line. A realistic ransomware recovery for small business budget, whether or not a ransom is paid, includes:

• Downtime. Payroll for staff who cannot work, missed appointments and billings, and clients or patients who go elsewhere while you are down. For a 20-person professional firm this is routinely the largest cost.
• Incident response. Forensics, breach counsel, negotiators, and the IT labor to rebuild systems, often at emergency rates.
• Notification and credit monitoring for every affected individual, plus regulatory filings and potential penalties.
• Replacement hardware and software where systems must be rebuilt or were too old to restore safely.
• Insurance consequences. Higher premiums, new exclusions, or non-renewal.
• Reputation. Published stolen data, public breach listings, and lost referrals.

IBM’s 2026 Cost of a Data Breach research puts the average U.S. breach well into the millions and the average time to identify and contain an incident at more than 200 days. Small businesses face smaller absolute numbers but a far larger share of revenue, which is why a ransomware recovery plan is one of the highest-return documents a business can write. Our guide to reducing IT costs explains why security spending belongs in the “do not cut” column.

Testing the Plan: The Tabletop Exercise

A ransomware recovery plan that has never been rehearsed will fail in small, predictable ways: the contact list is on the encrypted server, nobody knows who can authorize spending, the backup restore takes 30 hours instead of three. A tabletop exercise fixes this in an afternoon. Gather the owner, the office manager, your IT provider, and anyone named in the plan. Walk through a realistic scenario: it is 7:30 a.m. on a Monday, the front desk cannot log in, and there is a ransom note. At each step, ask who does what, with which tools, using which contact information.

Record every gap and assign a fix. Repeat annually and after any major change in systems or staff. Insurers increasingly ask whether you have done this, and the ransomware incident response steps become reflexes rather than a document nobody has read.

Ransomware Recovery for Small Business by Industry

Medical and dental practices

Patient care continues during recovery, so the ransomware recovery plan for a practice needs paper charting and scheduling procedures, a priority restore of the EHR, and a HIPAA breach analysis led by counsel. HHS requires a risk assessment for every ransomware incident involving ePHI. Our HIPAA compliance consulting team builds ransomware response into the contingency plan HIPAA already requires.

Law firms

Court deadlines and client confidentiality drive a law firm’s ransomware recovery plan: a way to keep filing from clean laptops, rapid restoration of document management, and ethics-informed client notification. Stolen matter files create exposure that outlasts the outage. See IT support for law firms.

Accounting and financial services

Ransomware during filing season is a favorite tactic, and ransomware recovery for small business accounting firms has to account for it. The FTC Safeguards Rule requires a written incident response plan for most firms, the IRS expects prompt reporting of taxpayer data theft, and client identity theft is the downstream harm. Our FTC Safeguards Rule for tax preparers guide covers the obligations.

Ransomware Recovery Plan: Frequently Asked Questions

How long does ransomware recovery take for a small business?

With tested immutable backups and a ransomware recovery plan, core systems can often be restored within a day or two. Without them, recovery commonly takes two to four weeks and may be incomplete.

Should we turn the computers off?

Disconnect them from the network but leave them powered on; this is the first of the ransomware incident response steps in every plan. Shutting down can destroy evidence in memory that responders use to identify the variant and sometimes recover keys.

Does cyber insurance cover ransomware?

Most policies cover response costs, business interruption, and sometimes the ransom itself, subject to the controls you attested to on the application. Missing MFA or backups you claimed to have can lead to a denied claim.

Is a ransomware attack a reportable data breach?

Usually, yes, and a ransomware recovery plan should assume so. Because attackers typically steal data before encrypting, regulators including HHS presume a breach unless forensics shows otherwise. Notification deadlines under HIPAA, the FTC Safeguards Rule, and New Jersey law start at discovery.

What is the single most important part of a ransomware recovery plan?

Backups the attacker cannot reach, tested regularly, are the core of any ransomware recovery plan. Everything else in the plan is easier when you know you can restore.

Get a Ransomware Recovery Plan in Place This Month

Ransomware is survivable for a small business that prepared a ransomware recovery plan and devastating for one that did not. eMDTec has helped New Jersey medical practices, law firms, accounting firms, and professional services businesses build and test ransomware recovery plans since 2002, and has guided clients through live incidents, as part of our cybersecurity services and managed IT services. Schedule a free consultation and we will assess your backups, your entry points, and your plan against this guide.