Shutting down server room air conditioning

Immediate payment of the ransom

Restarting all servers in the building

Publicly announcing the attack on social media before analysis

Deleting all log files

Isolating affected systems from the network (Containment)