It's important to disconnect and isolate the infected machine from the rest of the organization in the network. One reason is that some ransomware, such as wannacry, can spread to other computers in the network and amplify the damage. The hacker can also connect the infected machine and try to steal passwords and do further damage. Also, the infected machine should be handed over to the forensics team for investigation. Contact the security teams in your company and let them know if you have any kind of suspicion.