Ransomware Attack What to Do in Clarkston, GA

Ransomware Attack: What to Do If Your Clarkston Business Is Hit

Ransomware does not wait for business hours. If you are a Clarkston, Georgia business owner and encrypted files or a ransom note just appeared on your screen, the next 30 minutes matter more than the next 30 days. COMNEXIA has responded to ransomware incidents across DeKalb County and metro Atlanta since 1991, and the steps below reflect what actually works, not generic advice.

Step One: Isolate Before You Do Anything Else

The moment you suspect ransomware, disconnect the affected machine from your network. Unplug the ethernet cable or disable the wireless adapter through Windows Device Manager. Do not power off the device; a running system preserves forensic evidence in memory that your incident responder will need. If you have a managed switch, call your IT team to VLAN-isolate the affected segment immediately. Every second a compromised endpoint stays connected, the ransomware continues to enumerate network shares and encrypt additional files.

If COMNEXIA manages your environment, your SentinelOne EDR agent will have already attempted to autonomously quarantine the affected host using its Storyline Active Response engine. Your assigned technician receives an alert through our 24/7 SOC, which monitors endpoint telemetry around the clock. Call (877) 600-6550 immediately so we can confirm containment and begin triage.

Step Two: Do Not Pay the Ransom Yet

Paying a ransom does not guarantee file recovery and may violate U.S. Treasury OFAC regulations if the attacker is a sanctioned entity. Before any payment decision, COMNEXIA will determine whether your backups are intact. If your environment follows the 3-2-1 backup rule (three copies of data, on two different media types, with one copy stored off-site or in immutable cloud storage such as Azure Blob Storage with object-lock enabled), recovery from backup is almost always faster than negotiating with an attacker. Paying also does not close the vulnerability the attacker used to get in.

Step Three: Identify the Attack Vector

COMNEXIA pulls SentinelOne threat telemetry and Windows Event Logs to trace how the ransomware entered. Common entry points for Clarkston-area businesses include phishing emails that bypassed filtering, RDP exposed to the internet on default port 3389, and unpatched vulnerabilities on endpoints that lacked current patch cycles through NinjaOne RMM. Microsoft Entra ID sign-in logs frequently show the exact account that was compromised and from which IP address, which is why COMNEXIA enforces conditional access policies and MFA on all managed Microsoft 365 tenants before an incident occurs.

Step Four: Assess Your Compliance Obligations

Depending on your industry, a ransomware event triggers mandatory notification requirements. Clarkston-area businesses should evaluate the following:

• Auto dealerships using CDK Global, Reynolds and Reynolds, or Dealertrack: The FTC Safeguards Rule (16 CFR 314.4) requires a written incident response plan and notification to the FTC for any security event involving unauthorized access to customer financial data affecting 500 or more consumers. The CDK Global outage in June 2024 demonstrated that DMS-connected dealerships face lateral ransomware risk across integrated platforms.
• Healthcare or dental practices: HIPAA Breach Notification Rule requires notifying HHS and affected individuals within 60 days of discovering a breach involving unsecured protected health information.
• Businesses that store or transmit cardholder data: PCI DSS v4.0 requires incident logging, containment procedures, and forensic preservation of logs for at least 12 months.
• Georgia state law: Georgia's data breach notification law (O.C.G.A. 10-1-912) requires notifying Georgia residents without unreasonable delay when their personal information is compromised.

Step Five: Restore from Verified, Immutable Backups

COMNEXIA configures immutable backups with versioning enabled so ransomware cannot encrypt or delete backup copies. Before restoring, we verify the backup predates the initial compromise timestamp identified in the SentinelOne Storyline report. Restoring from a backup that is itself infected restarts the incident. We restore to a clean, re-imaged endpoint, then reconnect to your domain only after Microsoft Defender for Endpoint confirms no active threats on the restored device.

Step Six: Close the Door Before Coming Back Online

Returning to production without fixing the entry point guarantees a second attack. COMNEXIA deploys or verifies Microsoft Entra ID conditional access policies blocking legacy authentication protocols, enforces MFA on all accounts, rotates all service account credentials, and reviews NinjaOne patch status to close any unpatched CVEs the attacker may have exploited. We also schedule a phishing-simulation security-awareness training session within two weeks of any incident so employees recognize the lure that likely started it.

Get Immediate Help From a Clarkston-Area MSP

COMNEXIA has served DeKalb County and metro Atlanta businesses for 35 years from our Roswell, GA headquarters. If your business is experiencing a ransomware event right now, call (877) 600-6550. If you want to build the defenses that prevent paying that call in a crisis, ask us about our managed detection and response stack built on SentinelOne and Microsoft Defender for Cloud, purpose-built for dealerships and regulated businesses across the Atlanta metro.