Ransomware Attack on Your SME: The First 60 Minutes

49% of attacked Swiss SMEs are hit by ransomware. This guide walks you through what to do in the first 60 minutes, step by step, and what you must avoid at all costs.

Monday morning, 07:14. Your accountant reports that every file on the server has a new extension. On the screen, a ransom demand. The next 60 minutes will determine whether an incident becomes a catastrophe. According to the AXA SME Labour Market Study 2025, ransomware hits 49% of all attacked Swiss SMEs. The question is not if, but when.

Minute 0 to 15: Isolate and Document

Disconnect affected systems from the network immediately. Pull cables, disable Wi-Fi. Do not shut down the machines. The RAM contains forensic traces. Document everything with photos: screen messages, timestamps, affected systems. Notify your IT lead or your external IT partner.

Minute 15 to 45: Assess the Scope and Get Help

Determine which systems are affected and which are still running cleanly. Are backups reachable and intact? Contact your incident response provider. Report the incident to the BACS (if subject to mandatory reporting, within 24 hours). File a complaint with the cantonal police. Notify your cyber insurance provider.

What You Must Not Do

Do not pay the ransom without professional advice. 80% of companies that pay are attacked again. Do not attempt to decrypt systems yourself; you could destroy evidence. Do not communicate via compromised channels. Use mobile phones or a clean machine instead. Do not delete log files.

Preparation Is Everything

The best response starts before the attack. Create an incident response plan with phone numbers, roles and checklists. Test your backups monthly. Run a drill once a year. MilesGuard offers incident response retainers: in an emergency, we are reachable within 2 hours.