What should you do if attacked with ransomware?

Activate your incident response plan: isolate affected systems, identify the strain and scope, preserve evidence, and engage legal, insurance, and law enforcement. Avoid paying the ransom — it funds attackers and offers no guarantee of clean, complete recovery.

Recovery should target the most recent recovery point proven to be free of ransomware, not simply the newest backup. Elastio identifies that last known clean recovery point per asset in advance, which removes the attacker’s primary leverage; across Elastio customers, zero ransoms have been paid.

Last updated May 27, 2026