Restarting all servers in the building

Deleting all log files

Publicly announcing the attack on social media before analysis

Shutting down server room air conditioning

Isolating affected systems from the network (Containment)

Immediate payment of the ransom