Do you need help & advice with Business Continuity or Construction IT?
What is ransomware, and what does an attack do to a business?
If you run a business, ransomware is the attack most likely to stop you trading. Criminals get into your computers, lock every file so nobody can open them, and demand money to give them back. Most of the time they copy your files first as well, so they can threaten to publish them.
It sounds like something that happens to big names on the news. Schäfer Shop, a German office supply business, found out otherwise on 23 December 2022. The company later told the whole story in a case study published by Deutsche Bank, and in the video Dave Lane walks through it for business owners who aren’t technical.
What stands out is how little of it was about technology. What decided how it went were people things: who rang whom, who made the decisions, and what the staff were told.
Why did the criminals strike just before Christmas?
Because fewer people are watching. Criminals can sit inside a company’s computers for months before they make their move, and they like to strike in the holidays, when problems get noticed later and nobody stops them for longer. At Schäfer Shop the first sign was simply that the computers were behaving strangely. By 11 o’clock that morning there was no doubt: a note left on the main computers said the files had been locked and the data copied out.
That’s the usual pattern. Before they lock anything, criminals copy what’s worth most to you: the accounts, staff and customer details, anything confidential they can hold over you. They hunt for passwords too, because people use the same one in several places. Dave’s advice to anyone who keeps passwords in a spreadsheet is blunt: use a password manager, an app that remembers a different strong password for every system, so nobody needs the spreadsheet.
Get them a password manager. Do it today.
Dave Lane, GoodChoice IT
What should you do in the first hour?
Schäfer Shop cut its internet connection and switched everything off. Dave would do one thing differently, and the rest of the first hour comes down to who you ring and who decides.
- Unplug from the network, but leave the computers on. Pull the network cables and turn off the wifi, so the criminals can’t send your machines any more instructions. Left switched on, the computers still show the specialists what the criminals did.
- Ring your cyber insurer. As soon as you know it’s real, not tomorrow. Many insurers have their own team of attack specialists, on call day and night. Keep the policy number and the emergency number somewhere you can reach when the computers are down.
- Get the decision-makers in one room. Something odd is going on, but is it an attack? Make that call quickly, because every hour spent unsure is an hour the criminals keep.
- Split the work. One person handles staff, customers and suppliers. One works with the specialists on the technical side. The directors decide the big questions: what gets switched off, who gets locked out, what the business can afford.
The middle of an attack is no time to work out who is in charge. A written plan that settles it in advance pays for itself on the day, and our one-page emergency plan template is a good place to start.
What cyber insurance gives you: specialists, not just money
Schäfer Shop had cyber insurance, by what the company called a stroke of luck. Dave’s view: don’t leave it to luck, go and get it. If you’re in the UK and need a broker, we can introduce you to one, and our guide to what cyber insurers expect from construction firms shows what they’ll ask.
The money matters less than the people who come with it. For most businesses an attack is new territory; the insurer’s specialists deal with one every day. They tell you what to do next, find out how the criminals got in, and help with the parts IT isn’t set up for: telling customers, dealing with the press and meeting the legal deadlines.
Without cyber insurance you have to find those specialists yourself, in the middle of the attack, and they are very expensive. An IT company can step in, but Dave’s view is you won’t get the same kind of service. For legal advice too, he would lean on the insurer.
While I know a fair amount about cyber security, I’m nowhere near as expert as these guys are, and they’re dealing with this day in, day out.
Dave Lane, GoodChoice IT
Timing counts as well. Christmas is the busiest season for attacks, and it took Schäfer Shop half a day to find a team of experts who could start that evening. With an insurer that has its own team, Dave expects them to be working on it within 45 minutes. He has seen businesses put off calling their insurer. Ring them the moment you know.
Who do you have to tell, and how, when nothing works?
Picture it: you sit down at your desk and nothing works. No email, no address book, no Teams. Schäfer Shop’s people ended up searching old emails for colleagues’ mobile numbers. Settle these four now.
Be open from the start. People find out in the end, and hiding it only delays the inevitable. Schäfer Shop told its staff on Christmas Eve that it was dealing with a cyber attack, and found that being honest brought everyone closer together.
Open and transparent from day one. This is something I strongly recommend.
Dave Lane, GoodChoice IT
Should you pay the ransom?
The criminals gave Schäfer Shop seven days. A professional negotiator won two more to weigh up the risk, but in the end the company didn’t need to pay. It put everything back from its own backup copies, kept on magnetic tapes that were taken out of the machine and locked in a safe. Old-fashioned, Dave says, but if it’s tested and it works, it works.
Backups you have tested, kept apart from your other computers, are what let you say no.
Paying may or may not get you the key that unlocks your files, and without backups that work you may have no choice. Even with the key, everything has to be wiped and set up again, because you have to assume some of the criminals’ software is still hiding in there. Whether to pay depends on what was taken, what it’s worth to the business and how much cash you have. That’s a decision for the directors, not for IT.
How long does it take to get back up and running?
Schäfer Shop rebuilt everything from scratch. Every one of more than 1,000 devices in the building had to be set up again, along with the main computers, the door entry system and the phone system. Nothing was left as it was.
10 days
To be trading again, with restrictions. A very good result.
3 to 8 weeks
How long comparable firms told them they’d been shut down.
1,000+
Devices set up again from scratch, every one.
They kept the cleaned machines well away from the infected ones so nothing caught it again. Dave has seen businesses put red, amber and green stickers on every device so everyone knows which ones are safe. He has also seen businesses put everything back as it was and get hit again, so finding out how the criminals got in comes before switching anything back on. Old computers that no longer get security updates will simply be broken into again.
Certainly I’ve seen a month, six weeks, and a lot of businesses can’t survive that long without IT.
Dave Lane, GoodChoice IT
What did they change afterwards?
Four things. Dave’s view is that every business should have them in place already.
Four things to have in place before an attack
- A team watching your systems around the clock, so an attack is spotted and dealt with early.
- Long, unique passwords of at least 15 characters. Length matters far more than random symbols. Schäfer Shop said that rule had never been so easy to get agreed.
- A code from your phone as well as your password, on everything. Dave’s verdict: that should have been done already.
- Training, so staff spot scam emails and don’t click dodgy links.
If any of those are missing in your business, talk to us and we’ll help you put them in place.
Plan it before it happens
The company’s own advice to other businesses was to think it through beforehand. That’s a job for the owner and the directors, not something to hand to IT. A plan doesn’t need to be perfect to help: on the day you’re working through a list instead of thinking on your feet.
I can guarantee you, having a plan, even if it’s not quite there, makes a huge difference to how quickly you’re going to get things resolved.
Dave Lane, GoodChoice IT
Start with the questions nobody likes asking. If every computer stopped working tomorrow, who would you ring, and where is that number written down? If your people are spread across sites and none of their laptops will start, how do you get them working again? Get the key people round a table for an hour and talk it through.
The National Cyber Security Centre’s free Exercise in a Box gives you a ready-made attack to practise on, and our guide to what to do in a cyber attack covers the first few hours step by step.
Assume an attack will come. How much damage it does depends on what you planned before it did.
It’s 3 AM. Your project manager calls in a panic. No one can access the shared drive. Files are encrypted. Ransomware has hit your construction firm.
What you do in the next 4 hours will determine whether you recover quickly or lose weeks of work—and potentially your business.
This guide walks you through the critical first steps of ransomware recovery specifically for construction firms, where downtime means missed deadlines, lost contracts, and serious financial damage.
Hour 1: Immediate Response and Containment (First 60 Minutes)
Minute 1-5: Confirm the Attack
- Don’t assume it’s a technical glitch—check for ransom notes, encrypted files (.locked, .encrypted extensions), or unusual file names
- Look for ransom notes (often TEXT files on desktop or in folders)
- Take photos of ransom messages with your phone—don’t rely on screenshots
Minute 6-15: Isolate Affected Systems
- Disconnect from network immediately: Unplug ethernet cables, disable WiFi
- Don’t shut down infected machines—this can destroy forensic evidence and complicate recovery
- Disable any cloud sync services (OneDrive, Dropbox, SharePoint sync)
- Identify and isolate any other potentially infected devices
Minute 16-30: Ring Your Cyber Insurer and Your IT Provider
- Ring your cyber insurer’s emergency line as soon as you know it’s real, not tomorrow. Many insurers have their own team of attack specialists on call day and night, and your policy may only pay out if you tell them quickly. Keep the policy number and emergency number somewhere you can reach when the computers are down.
- Don’t pay anyone, or bring in your own specialists, before your insurer agrees: it can affect what they cover
- Contact your IT provider or security team immediately
- If you don’t have an IT provider, now is the time to call one (like GoodChoice IT)
- Do NOT attempt to “fix” this yourself—ransomware spreads quickly
Minute 31-45: Preserve Evidence
- Take photos of error messages, ransom notes, and encrypted files
- Document which systems are affected and when the attack was discovered
- Don’t delete anything—forensics are important for insurance claims and law enforcement
Minute 46-60: Notify Stakeholders
- Inform senior management immediately
- If you haven’t already, ring your cyber insurer now
- Tell clients early and honestly what’s affected and when you expect to be back up and running
Hour 2: Assessment and Decision-Making (60-120 Minutes)
Determine the Scope of the Attack
- Which systems are infected? (File servers, workstations, project management tools)
- Has the ransomware spread to backups? (This is critical—many attacks target backup systems)
- Are your project files, CAD drawings, site photos, contracts affected?
- Check whether cloud-based tools (Microsoft 365, Procore, etc.) are compromised
Assess Your Backup Situation
- Do you have recent, clean backups? If yes, recovery is faster and cheaper
- Are backups offline and isolated? Online backups may also be encrypted
- When was the last successful backup? Days? Weeks? This determines data loss
- Test a small restore to verify backups are actually usable
To Pay or Not to Pay the Ransom?
This is the hardest decision. Here’s what to consider:
Arguments AGAINST Paying:
- No guarantee you’ll get your data back
- You’re funding criminal operations
- You become a target for future attacks
- Some ransomware groups provide faulty decryptors
- Legal and regulatory issues in some jurisdictions
When Payment Might Be Considered:
- No viable backups exist
- Data loss would bankrupt the company
- Restoration time exceeds acceptable downtime
- Cyber insurance covers the ransom
Important: Consult with your IT security team, insurance provider, and legal counsel before paying any ransom.
Hour 3: Begin Recovery or Negotiate (120-180 Minutes)
If You Have Clean Backups:
- Begin restoring systems from the most recent clean backup
- Prioritise critical systems: accounting, project management, client communications
- Verify backups are truly clean before restoring
- Change ALL passwords before reconnecting systems
- Scan restored systems with updated antivirus before bringing them online
If You’re Considering Paying the Ransom:
- Engage a professional negotiator (many cybersecurity firms offer this service)
- Never use your business email to communicate with attackers
- Negotiate the price—ransoms are often inflated and negotiable
- Get proof the decryption key works before paying
- Document all communications for law enforcement and insurance
Communicate with Your Team
- Inform employees what’s happening (without revealing sensitive details)
- Establish alternative communication methods (personal phones, WhatsApp)
- Set expectations for downtime and recovery timelines
- Warn employees about phishing emails related to the attack
Hour 4: Implement Security Measures and Plan Forward (180-240 Minutes)
Secure Your Environment Before Restoring
- Identify and patch the vulnerability that allowed the attack
- Enable multi-factor authentication (MFA) across all systems
- Reset ALL passwords—not just admin accounts
- Review user access permissions and remove unnecessary admin rights
- Deploy endpoint detection and response (EDR) software
Report the Incident
- File a report with Action Fraud (UK) or your local cybercrime unit
- Notify your cyber insurance provider with full documentation
- If personal data was compromised, report to the ICO within 72 hours (GDPR requirement)
- Consider notifying clients if their data may be affected
Create a Communication Plan
- Prepare messaging for clients about potential delays
- Coordinate with your legal team on disclosure obligations
- Brief your team on what they can and cannot say publicly
- Monitor for data leaks on the dark web (many ransomware groups threaten to publish stolen data)
Begin Post-Incident Analysis
- How did the attackers get in? (Phishing email, RDP vulnerability, compromised credentials?)
- What could have prevented this?
- Why did backups fail (if they did)?
- What systems need better protection?
What Happens After Hour 4?
The first 4 hours are critical, but ransomware recovery is a marathon, not a sprint.
Week 1 Priorities:
- Complete system restoration
- Conduct full security audit
- Implement additional security controls
- User training on phishing and security awareness
Long-Term Actions:
- Regular penetration testing
- Continuous security monitoring
- Quarterly backup testing
- Cyber insurance review and renewal
Prevention: How Construction Firms Can Avoid Ransomware
The best ransomware recovery plan is one you never have to use.
- Implement the 3-2-1 backup rule: 3 copies of data, on 2 different media types, with 1 copy offsite
- Enable MFA everywhere: Email, VPN, cloud services, remote access
- Train employees on phishing: Most ransomware starts with a malicious email
- Patch everything: Operating systems, applications, firmware
- Segment your network: Isolate critical systems from general users
- Restrict admin rights: Users shouldn’t have admin access to their workstations
- Deploy EDR software: Detects and blocks ransomware before it spreads
GoodChoice IT Can Help
If you’re reading this after an attack, contact us immediately at GoodChoice IT. We specialise in rapid ransomware response for construction firms and can help you recover faster.
If you’re reading this as prevention, even better. We offer:
- Ransomware readiness assessments
- Backup testing and validation
- 24/7 security monitoring
- Incident response planning
- Employee security training
Don’t wait until it’s too late. Contact GoodChoice IT today to protect your construction business from ransomware.
More videos on this
Frequently Asked Questions
Should I shut down my computer if I suspect ransomware?
No. Leave it powered on but disconnect it from the network. Shutting down can destroy forensic evidence and make recovery harder.
How long does ransomware recovery typically take?
It depends on the extent of the attack and the quality of your backups. With good backups, you might recover in 24-48 hours. Without backups, it could take weeks.
Will my cyber insurance cover the ransom?
Some policies do, but coverage varies widely. Check your policy and notify your insurer immediately after an attack.
Can ransomware spread to my cloud backups?
Yes, if your cloud backups are continuously synced and have write access. This is why offline, immutable backups are critical.
Should I report ransomware to the police?
Yes. Report to Action Fraud in the UK. Law enforcement can sometimes help with decryption tools and tracking attackers.
How do construction firms usually get ransomware?
Most commonly through phishing emails, RDP vulnerabilities, or compromised credentials. Construction firms are targeted because they handle valuable project data and often have weaker cybersecurity.
Is it illegal to pay a ransom in the UK?
Not in itself, for a private business. It becomes a crime if the money ends up with a person or group under UK financial sanctions, and you often can’t tell who is behind an attack. The government guidance on cyber sanctions sets out that risk, and your insurer’s specialists will check it before any payment is even discussed.
Do we have to report a ransomware attack to the Information Commissioner's Office?
Only if people’s personal details are involved and the breach is likely to put them at risk, for example of fraud or identity theft. Then you report it as soon as possible, and within 72 hours of finding out where you can. If the risk to people is high, you have to tell them too. Either way, keep your own record of what happened and why you decided what you did. The regulator’s website has a short self-assessment that helps you decide.
Does cyber insurance help if we get ransomware?
Yes, and the money is the smaller part. Many insurers have their own team of attack specialists on call day and night. They tell you what to do next, find out how the criminals got in, and help with telling customers and meeting the legal deadlines. Keep the policy number and emergency number somewhere you can reach when the computers are down, and ring as soon as you know it’s real. Without insurance you have to find and pay those specialists yourself.
Can we get our files back without paying?
Usually, if you have backups that work and were kept apart from the computers that were hit. If you don’t, keep a copy of the locked files. The police sometimes take down a ransomware gang and release the keys, and No More Ransom, a site set up by Europol, the Dutch police and two security companies, offers free tools that open the locked files for many types of ransomware.
How much does it cost to recover from ransomware?
It depends on the size of the business and what was taken, but it’s rarely small: specialist investigators, sometimes a second team, every device set up again, weeks of lost trading and legal advice. Schäfer Shop brought in a second team on Christmas Eve. For a larger business the bill can run into millions, so budget for it and check what your cyber insurance covers before you need it.
