1. How to respond to ransomware threats: Identify the infected machine
Discover where the attack first struck to limit further damage. This will normally be the person who first reported the issue.
The earlier this information is found, the quicker the threat can be contained and the version of ransomware used identified.