The first ten minutes: isolate, photograph, touch nothing else
The first step is isolation. Not shutting down, and not running antivirus. Unplug the network cable from the affected computer, turn off its wireless and Bluetooth, and disconnect any external drive or USB stick. If the office uses shared folders or a file server, have everyone disconnect immediately and pause the cloud sync client on each machine. Otherwise the encrypted files are treated as new versions and uploaded, overwriting the good copies in the cloud. If you cannot tell which machines are affected, taking the whole office network down for half an hour is the safer choice.
The second step is photographs. Use a phone to capture the ransom screen, the text of the ransom note, the new file extensions, and any contact details or deadline shown. These go into the police file and help a technician identify the ransomware family and whether a public decryption tool exists. Do not click any link or button on the ransom screen.
The third step is restraint. Do not reformat or reinstall, which destroys evidence and possible recovery clues. Do not keep restarting, because some ransomware resumes encrypting on every boot. Do not download a decryption tool you found by searching, since many are malware themselves. Do not sign in to online banking, email or any company account from that computer. Set the machine aside with a note saying do not power on, do not connect, and move to a clean device for the next steps: informing the person in charge, changing important passwords, calling a technician. If you do only these three things in the first ten minutes, you are already ahead of most companies that go through this. Everything that follows is easier when the infection has been contained to one desk rather than the whole office.
The next two hours: map the damage, and above all check whether a backup is alive
The single most important question in a ransomware incident is whether a backup exists and whether it is clean. List every backup the company might have: an external drive, another computer, file server snapshots, version history in a cloud drive, the built-in backup of the accounting software, the copy sent to the accountant or an outsourcing vendor. Do not plug a backup drive into a machine that may be infected; inspect it from a computer you know is clean. Many cloud drives keep previous versions of each file, so even if encrypted files were synced you can often roll back. For small companies this is the most common lifeline.
At the same time, map the scope. Which machines show a ransom note? Which shared folders have changed file extensions? Are the accounting files and customer records among them? Were the computers used for company email and online banking affected? Put the results in one table: device, status, important data held, backup available or not.
Then change passwords from a clean device: company email first, then online banking and payment tools, then cloud storage, accounting software and social media back ends. Many ransomware attacks sit inside a system for some time before encrypting and may already have collected credentials. Check the mailbox for forwarding rules nobody created; the same groups often run business email compromise fraud. If nobody in the company is technical, this is the moment to bring in outside help through an established repair or IT service provider; see computer repair and service channels in the Philippines. Do not hand machines to an unknown recovery expert who contacts you first, however confident they sound.
Whether to pay: the advice is no, for four reasons
Paying the ransom is not advisable. This is not a moral position but four practical points. First, payment does not guarantee decryption. The other side is a criminal with no obligation to perform; the tool supplied may fail, may unlock only part of the data, or may never arrive. Second, payment invites more demands. Victims who pay are marked as willing; some are asked for a further sum straight away and some are hit again months later. Third, payment fixes nothing underneath. The way in is still open, a backdoor may remain, and the attacker may hold a copy of your data.
Fourth, the payment itself can create legal and compliance exposure. You do not know who receives it, and sending cryptocurrency to an unidentified party can raise anti-money-laundering and sanctions questions, as well as being hard to explain in the company's books. So even if someone inside the company argues for paying to make the problem go away, hold that discussion only after isolation, a backup check and advice from a technician and a lawyer, never under the pressure of the countdown on the screen. The countdown is the attacker's negotiating tactic. It is not your deadline.
If the attacker also threatens to publish your data unless you pay, the event is a data exposure as well. The handling logic is the same as for any extortion: do not negotiate, keep the evidence, report it; see how to respond to extortion and file a complaint. You must also assess whether the data taken includes personal information of customers or staff. If it does, the company may owe notification to the privacy regulator and to the individuals, as set out in the customer data breach response guide. That duty applies whether or not any ransom is paid.
How to recover: rebuild from a clean backup rather than patching the infected system
The sound path is clean first, rebuild second: wipe and reinstall the affected machines completely, then bring data back from a backup you have confirmed is clean. The order cannot be reversed. A common mistake is connecting the backup before the entry point is understood, so the backup is encrypted too. Another is deleting the ransomware program and carrying on, leaving a backdoor that brings the attack back weeks later. Ask the technician two questions before anything is restored: how did they get in, and is that door now closed? Phishing attachments, weak remote desktop passwords, pirated software and unpatched systems are the usual answers.
Restore in order of what keeps the business running. Start with what lets the company collect money and pay salaries: accounting files, customer orders, the device used for online banking. Then everyday working files. Historical archives come last. For files with no backup, have the technician check whether a public decryption tool exists for that ransomware family. Security vendors and law enforcement publish such tools and they work on some older strains, but do not count on it. Keep a copy of any encrypted files you cannot recover, in case a tool appears later.
Losing accounting and tax data has a compliance consequence as well. Books of account and invoicing records must be retained by law, so lost records need to be reconstructed and the tax authority may need an explanation. The accountant's filing working papers, bank statements, issued invoices and customer correspondence are the raw material; the form requirements are in the books of accounts registration guide. Keep a recovery log: which machine was reinstalled on which day, which backup was used, which data is confirmed lost. You will need it for the police, the insurer and any later explanation.
Police, insurer and notification: three separate calls
A ransomware attack is a cybercrime and can be reported to the police anti-cybercrime unit or the National Bureau of Investigation's cybercrime division. Bring the company's registration documents with the authorised representative's ID and authorisation letter, photographs of the ransom screen and note, the timeline, the list of affected devices, and any contact details or payment address the attacker left. If the infected machine has not been reinstalled, tell the investigators it has been preserved and let them decide whether to examine it. Keep expectations realistic: the attackers are usually abroad and quick arrests are uncommon. The official record, however, is the most persuasive document you will have when dealing with an insurer, explaining the incident to customers and partners, or answering a regulator.
The second call is insurance. If the company holds cyber cover, or a property or business interruption policy with a relevant clause, notify the insurer within the time the policy sets and ask whether it requires an approved technical provider. Do not dispose of equipment the insurer may want inspected until they confirm.
The third is notification. If the encrypted or copied data includes personal information of customers or employees, assess under the Data Privacy Act whether this is a notifiable personal data breach; the window is short. If you process data for another company, inform that client promptly. Tell your own staff as well: what happened, which passwords to change, and to be alert for emails impersonating the company in the coming weeks. In external communication state facts only and do not speculate about who was responsible. Have a licensed lawyer review notification decisions and the wording of any public statement before it goes out.
Not getting hit again: five things a small company can actually do, and what Yixing can do
Ransomware favours small companies with no backup and unpatched systems because they are the most likely to pay. Defending against it takes five habits, not a large budget. One: keep three copies of important data on two kinds of media with one copy offline, for example the working copy, a cloud drive and an external disk that is unplugged and locked away each week. The offline copy is the one ransomware cannot reach. Two: actually restore from backup once a quarter; an untested backup does not count. Three: turn on automatic updates and stop using pirated operating systems and cracked software, which are a leading source of infection.
Four: tighten remote access. Switch off remote desktop where it is not needed and protect it with a strong password and two-step verification where it is, and turn on two-step verification for company email, cloud storage and online banking. Five: teach staff to recognise phishing. Unknown attachments stay closed, compressed files and documents with macros deserve particular suspicion, and invoice, courier and court notice are the usual bait subjects. Give each person only the access they need: the front desk computer should not be able to write to the finance share. A lost device is the other common data incident; see what to do when a work laptop or phone is stolen.
Yixing Travel Consultancy (SEC Registration No. CS202009551, Bureau of Immigration Accredited Agency No. CA-202624381-1) provides compliance retainer services to foreign-owned companies in the Philippines: assembling the company documents and timeline a complaint requires, helping the accountant reconstruct books and filings for the affected period, organising the facts needed to assess a privacy notification duty, and connecting you with licensed counsel. We are not a cybersecurity firm and do not perform decryption, forensics or system rebuilds; those belong with technical specialists. For your specific case consult a licensed lawyer; this article is not legal advice.
Frequently Asked Questions
Our computer has ransomware. What is the first step?
Should we pay the ransom to get the files back?
We have no backup. Can the files still be recovered?
The ransom note has a countdown and says files will be deleted. What should we do?
Should a ransomware attack in the Philippines be reported, and to whom?
The attacker threatens to publish our customer data. Do we have to notify anyone?
Our accounting files were encrypted. Is there a tax problem?
Let’s talk through your situation — free
Every company is different. Leave your details and a Chinese-speaking advisor will get back within 1 business day with practical, industry-specific guidance and a transparent quote.
Get help with Compliance & Retainer → Free consultation