I have taken two calls like this in the past year. Both started the same way: someone opened an attachment on a Friday afternoon, and by Monday morning the accounting machines were showing a ransom note. What those incidents taught me is that the first 24 hours decide whether a business loses a weekend or loses itself.
Disconnect first, read nothing
The first instinct is to open the ransom note and start bargaining. Do the opposite. Pull the network cable, switch off the Wi-Fi, get the affected machines off the network. Ransomware walks the wire, so every minute a box stays connected, another shared folder gets encrypted. Then call someone: your IT person, your hosting provider, anybody who answers the phone. Leave the encrypted files exactly as they are and don't run cleanup tools you find in ads. How the attacker got in is the evidence that prevents round two.
Know what you actually have
Before you discuss money with anyone, answer three questions. When was your last good backup taken? Is it off the network? What data could you not rebuild if it vanished? If the answer is last night, off-site, and nothing critical, you are having a bad week: restore, find the hole, patch it, move on. If it isn't, you are in a worse conversation, and I will say the quiet part out loud: most of these crews now threaten to publish the stolen data as well, so paying buys you nothing you can count on. You lose the money and still get extorted.
The unglamorous part
Every recovery story that ends well has the same boring prequel. Offline backups that were actually tested, patching that kept up, MFA on the accounts that matter, and one person who knew the plan before the panic. None of it costs a fortune. It costs an afternoon a month and a provider who does restore drills instead of just taking your hosting fee. We do that work for the businesses we look after, and honestly, it is the part of the job I would hate to be judged on after the fact.
Already living this right now? Unplug everything, change nothing else, and call. The order matters.