What should I do immediately after a ransomware attack?

Summary:

Disconnect infected systems from the network. Don’t delete or rename encrypted files. Contact a cybersecurity expert or incident response team. Preserve logs and evidence for investigation.