Should I shut down my computers when I see a ransom note?

No. Disconnect affected machines from the network and the internet, but leave them powered on. Shutting down can wipe forensic evidence in memory that responders need to understand the attack. Isolation stops the spread without destroying clues.

How long was the attacker inside before the ransom note appeared?

Usually days to weeks. Ransomware groups break in quietly, steal patient data, locate and disable backups, then trigger encryption at night or over a weekend. The note you see is the final step, not the beginning.

What protects a dental practice from losing everything?

Off-site, immutable backups the attacker cannot reach, alter, or delete. Practices with clean, isolated backups can restore on their own and avoid paying. Backups stored on the same network as the infected systems are typically encrypted alongside them.

Who should I call first?

Call your IT provider or managed service provider immediately, then your cyber-insurance carrier's incident hotline. Most healthcare practices are not fully staffed for security, so an external partner usually drives the technical response in the first hour.

What Happens in the First Hour of a Ransomware Attack

Q: Should I pay the ransom to get my practice running again?

Not as a first-hour decision. CISA and the FBI advise against paying because it funds future attacks and guarantees nothing: paying does not ensure you get all your data back. Decide with your insurer's breach coach, not under pressure.

Did the attack really start this morning?

No. By the time a ransom note appears, the attacker may have been inside your network for days or even weeks. The note is the last step, not the first. Ransomware groups break in quietly, look around, find where your patient data and your backups live, steal a copy to extort you with later, and only then trigger encryption, almost always at night or over a weekend when no one is at the front desk to react.

That lead-up matters because it explains the most painful surprise in dental ransomware: practices that thought they had backups discover the backups were encrypted too. In January 2026, Tampa Bay Dental Implants & Periodontics in Florida identified a ransomware incident affecting an internal legacy server, which the practice said held a backup of its electronic medical records; HHS lists 6,400 individuals (HHS breach portal, HIPAA Journal). The lesson holds for any practice: a backup kept on a server the network can reach is exposed to the same attack as the data it protects. We unpack exactly how that happens in why your dental backup got encrypted too.

Here is how a realistic first hour actually unfolds.

A timeline of the first hour

Before the ransom note — The attacker may already be inside

Nothing looks wrong. Charts open, X-rays load, claims go out. In the background, a stolen credential or an unpatched remote-access tool has given an intruder a foothold. They are mapping shared drives, copying patient files, and quietly identifying your backup system so they can disable it before they strike. This is why a strong perimeter is not enough on its own.

0:00 — The ransom note appears

A staff member arrives, wakes a workstation, and finds a text file or full-screen message demanding payment in cryptocurrency. Practice management software will not open. Files have strange new extensions. Action: stay calm and do not interact with the note. Do not click links or "decrypt" buttons.

0:05 — Isolate, do not power off

The instinct is to shut everything down. Resist it. Action: unplug network cables and disable Wi-Fi on affected machines, and disconnect the practice from the internet, but leave the computers powered on. Powering off can destroy forensic evidence in memory that helps responders understand the scope. Isolation stops the spread; shutdown destroys clues.

0:10 — Stop the bleed across the fleet

Ransomware moves laterally. Action: isolate the server and any networked device sharing files, including imaging machines and any connected backup appliance. If you cannot tell what is infected, isolate everything and let your IT provider sort it out.

0:15 — Notify your IT or MSP

Action: call your IT provider or managed service provider now, not by email. They will begin scoping which systems are hit and whether clean backups exist off-site. In CDW's 2024 cybersecurity research, only 14% of healthcare IT leaders surveyed said their security teams were fully staffed (HealthTech Magazine), so many practices depend on an external partner for exactly this moment.

0:25 — Call your cyber-insurance carrier

Action: notify your cyber-insurance carrier through their incident hotline. Most policies require prompt notification and provide a breach coach and approved forensics firm. Calling late can jeopardize coverage. Do this before making any other decisions.

0:35 — Document everything

Action: photograph the ransom note, write down the exact time you discovered it, list affected machines, and note anything unusual staff saw recently. This record feeds insurance, forensics, and any later regulatory reporting.

Do not pay yet — and probably not at all. CISA and the FBI advise against paying ransoms: payment funds future attacks and guarantees nothing. Paying does not guarantee recovery: in Sophos's 2021 survey of mid-sized organizations, only 8% of those that paid got back all of their encrypted data, and they recovered about 65% of it on average (Sophos). Paying is a last resort, decided with your breach coach, not a first-hour reflex.

0:45 — Pause operations and protect patients

Action: decide with your team whether to continue seeing patients on paper or reschedule. Do not reconnect any device to the network to "check" something. A reconnected machine can re-trigger encryption across systems you just isolated.

0:55 — Confirm your recovery position

This is the question that decides everything. Action: with your provider, confirm whether you have an off-site backup the attacker could not touch. If your only backups lived on the same network, on a mapped drive, or on a connected NAS, assume they are compromised.

Beyond the first hour

The first hour is containment. Recovery, breach notification under HIPAA, and getting the practice running again is a longer, structured process. We walk through all of it in the dental ransomware recovery playbook.

Why the backup question is the whole game

Every decision in that hour bends toward one outcome: can you restore without the attacker's key? Practices with clean, isolated backups recover on their own. True Dental Care for Kids and Adults, a Pennsylvania practice, disclosed in April 2025 that an unauthorized party had encrypted its data around February 3, 2025, and said it did not pay; HIPAA Journal reported that 17,640 individuals were notified and that files were restored from backups (HIPAA Journal). Practices without them face a worse menu: paying a ransom demand (Comparitech put the 2025 average demand against healthcare providers at about $615,000, Comparitech), weathering weeks of downtime (over 17 days on average in Comparitech's 2018 to 2024 data, Comparitech), and absorbing recovery costs (a mean of about $1.02 million in Sophos's 2025 survey, Sophos). Comparitech counted 636 ransomware attacks on the healthcare sector in 2025, 445 on care providers and 191 on healthcare businesses; attacks on providers were flat from 2024 (437), while attacks on healthcare businesses rose 25% (Comparitech). This is not a rare scenario.

The attacker's whole strategy depends on reaching your backups during those quiet days before the note appears. DDSArk's approach is built to defeat exactly that: immutable, write-once copies stored encrypted and off-site, run by your practice or your IT partner. Because the backups live outside the network the attacker compromised and cannot be altered or deleted, the ransom note becomes an inconvenience instead of a catastrophe. The recovery target is set with your provider.

The first hour is survivable. What makes it survivable is a decision you make long before it starts.