What should I do immediately after discovering a ransomware attack?

Upon discovering a ransomware attack, immediately disconnect the affected device from the internet and any networks to prevent further spread. Document the incident, including any ransom notes, and contact your IT department or a cybersecurity expert for assistance. Do not pay the ransom, as it may not guarantee data recovery and can encourage future attacks.