Ransomware recovery is something no Manchester business plans for, but every business should prepare for it. In the past two years, SMEs across Greater Manchester and Sale have been hit by ransomware attacks that locked staff out of systems for days, cost tens of thousands in recovery costs, and in some cases permanently damaged customer trust. If it happens to your business, the next few hours are critical. This guide walks through the ransomware recovery process: from the moment of attack to the point where your systems are rebuilt and hardened against the next attempt.
What Happens the Moment Ransomware Strikes
The first sign is usually a warning screen, a ransom note demanding payment, often in cryptocurrency, in exchange for a decryption key. By the time that screen appears, the damage is already done. The ransomware has been running silently across your network, encrypting files, sometimes for hours or even days before triggering.
At this point your instinct might be to panic, pay, or restart everything. All three are mistakes.
The First 60 Minutes: What You Should Do
- Isolate affected systems immediately. Disconnect from the network, physically if needed. Do not wait for a clean shutdown.
- Do not pay the ransom yet. Payment does not guarantee decryption, and it funds further criminal activity.
- Call your IT support team. If you have managed IT support in place, this is exactly the moment it earns its keep.
- Preserve evidence. Don’t wipe anything before a forensic assessment. Logs and system snapshots are vital for insurance claims and ICO notifications.
Ransomware Recovery: The Step-by-Step Process
Proper ransomware recovery is not a quick fix. It follows a structured process, and skipping steps creates vulnerabilities that attackers exploit in a second wave.
Step 1 – Contain the Attack
The priority is stopping the spread. Segment your network, disable compromised accounts, and revoke remote access credentials. Your IT team should identify patient zero, the device or user account where the infection began, so containment is targeted rather than chaotic.
Step 2 – Assess the Damage
Once contained, the forensic assessment begins. This means identifying which systems are affected, which data has been encrypted, and whether data has been exfiltrated. Many modern ransomware groups use double extortion, encrypting your data and threatening to publish it publicly if the ransom is not paid. Your IT team will look for indicators of exfiltration in network logs.
Step 3 – Notify the Right People
This step is frequently skipped and it shouldn’t be. If personal data has been compromised, UK GDPR requires you to notify the ICO within 72 hours. Contact your cyber insurer immediately, many policies have specific incident response obligations that, if missed, void the claim. If customer or employee data is involved, consider your legal notification obligations.
Step 4 – Restore from Backups
This is where the quality of your backup strategy determines everything. Businesses with clean, tested, offsite backups, following the 3-2-1 rule (three copies, two media types, one offsite), can restore with minimal data loss. Businesses without proper disaster recovery in place face a much harder road.
Before restoring, the backup must be verified as clean. Ransomware can lie dormant in backups, meaning a compromised restore just triggers the attack again. Your IT team should scan backup images before deployment.
Step 5 – Rebuild and Harden
Recovery is not just about getting systems back online. It is an opportunity to fix the vulnerabilities that allowed the attack in the first place. This means reviewing patch levels, enforcing multi-factor authentication, replacing weak passwords, reassessing remote access configurations, and implementing or updating endpoint detection tools.
Should You Pay the Ransom?
The advice from the UK National Cyber Security Centre (NCSC) and National Crime Agency (NCA) is clear: do not pay. Paying the ransom does not guarantee you will receive a working decryption key, and it marks your business as a willing payer, making you a target for repeat attacks. There are also legal considerations, as paying ransoms to sanctioned entities can expose your business to regulatory risk.
That said, the decision is rarely straightforward when critical business data hangs in the balance. This is a conversation to have before an attack happens, not during one. Your cybersecurity policy should include a clear position on ransom payment before you are ever in that room.
How Long Does Ransomware Recovery Take?
For businesses with good backup infrastructure and an experienced IT partner, core systems can be restored within 24 to 72 hours. Without proper backups, recovery from scratch can take one to three weeks, during which the business is largely offline.
The average cost of a ransomware attack on a UK SME, including downtime, recovery, lost revenue, and reputational damage, runs into tens of thousands of pounds, even when no ransom is paid. For Sale and Manchester businesses operating on tight margins, that scale of disruption can be existential.
The Role of Your IT Support Partner
A managed IT support provider does not just fix things after they break. In a ransomware scenario, they provide immediate incident response, forensic capability, coordinated containment, and a structured recovery roadmap. They also liaise with your insurer and, if required, support regulatory notification.
PC Express IT supports businesses across Manchester, Sale, Altrincham, Trafford, and Salford with IT support that includes proactive monitoring, managed backup, and incident response. If you do not have a clear plan for what happens after a ransomware attack, now is the time to build one, before you need it.
Preventing the Next Attack
Ransomware recovery is hard. Prevention is significantly cheaper. The fundamentals that stop most attacks are well known: regular patching, enforced multi-factor authentication, email filtering, staff awareness training, and endpoint detection and response (EDR) software. None of these are expensive or complex, but all require consistent implementation and oversight.
If you need a post-incident review or want to assess your current exposure before an attack occurs, contact PC Express IT for an IT security assessment. We work with businesses across Sale and Greater Manchester to build practical, affordable cyber defences that fit the way you work.
Ransomware Recovery: Frequently Asked Questions
What is the first thing I should do if my business is hit by ransomware?
Immediately isolate affected devices from your network by disconnecting them from Wi-Fi and unplugging network cables. Do not restart or shut down infected systems, and do not pay any ransom demand. Call your IT support team straight away and document everything you see on screen for your insurer and any regulatory notifications.
Should a Manchester business pay a ransomware demand?
The NCSC and NCA both advise against paying. Payment does not guarantee decryption, funds criminal operations, and can mark your business as a repeat target. There may also be legal implications if the ransomware group is a sanctioned entity. The better path is restoring from clean backups with professional IT support.
How long does ransomware recovery take for a small business?
With tested, offsite backups in place, core systems can often be restored within 24 to 72 hours. Without proper backups, recovery from scratch typically takes one to three weeks. The quality of your backup strategy is the single biggest factor in recovery speed.
Do I need to notify the ICO after a ransomware attack?
If personal data has been compromised, encrypted or exfiltrated, you are required under UK GDPR to notify the ICO within 72 hours of becoming aware of the breach. You may also have obligations to notify affected individuals. Your IT support partner and legal adviser should be involved in this decision quickly.
Can ransomware spread through backups?
Yes. If backups are connected to your network or stored on the same systems, ransomware can encrypt them too. Properly isolated, offsite backups following the 3-2-1 rule are far more resilient. Before restoring from any backup after an attack, your IT team should verify it is clean and free of dormant malware.
What does ransomware recovery actually cost?
For UK SMEs, the total cost of a ransomware attack, including downtime, IT recovery, lost revenue, and reputational damage, typically runs into tens of thousands of pounds even without paying a ransom. Cyber insurance can offset some of these costs, but prevention and proper backup infrastructure are far cheaper than recovery.
How can PC Express IT help with ransomware recovery in Manchester?
PC Express IT provides incident response support, managed backup and disaster recovery, endpoint security, and ongoing IT support for businesses across Manchester, Sale, Altrincham, and Trafford. We can help you respond to an active incident, recover your systems, and build defences to prevent recurrence. Contact us to discuss your situation.
