Disconnect affected computers from the network (unplug the cable, turn off Wi-Fi) but do not power them off, do not pay or contact the attacker, do not restore backups yet, and call Axio Networks at 480-602-2946. Preserving the current state helps investigation and recovery.