by Quick answer: In the first 24 hours of a ransomware attack: isolate affected systems from the network (do not power them off), call your incident response provider and legal counsel, preserve evidence, protect backups, and do not decide on payment until you have legal advice. Speed matters, but so does not destroying evidence.
Hour 0–1: Contain
- Disconnect affected devices from the network. Unplug network cables and disable Wi-Fi. Do not shut machines down; memory can contain evidence.
- Isolate, don’t wipe. Do not reimage or delete anything yet.
- Disable compromised accounts and stop remote access such as VPN if you suspect it is the entry point.
- Protect your backups. Disconnect backup systems and check that they are not encrypted.
Hour 1–4: Call the right people
- Incident response provider. Bring in specialists. If you have cyber insurance, call the insurer’s hotline first; many policies require using their approved responders.
- Legal counsel. Involve them early so investigation work can be protected by privilege where possible.
- Internal leadership. Name one incident lead and one communications lead.
- Law enforcement. In the US, report to the FBI (IC3) and CISA. Reporting does not slow your recovery and may provide useful intelligence.
Hour 4–12: Understand scope and preserve evidence
- Capture the ransom note, file extensions and any contact details, with screenshots.
- Preserve logs from firewalls, VPN, email, endpoint tools and identity systems before they roll over.
- Work out which systems and data are affected and whether data was stolen as well as encrypted.
- Look for how the attacker got in: phished credentials, exposed remote access or an unpatched system.
Hour 12–24: Plan recovery and communication
- Decide what must be restored first, based on business impact.
- Verify backups are clean before restoring, and rebuild rather than clean where in doubt.
- Reset credentials, starting with privileged and service accounts, only once the attacker is out.
- Prepare holding statements for staff, customers and regulators. Check notification obligations such as HIPAA, state breach laws or contractual duties.
Should we pay?
Payment is a business and legal decision, not a technical one. Payment does not guarantee you get working decryption, does not guarantee stolen data is deleted and can expose you to sanctions risk if the attacker is a sanctioned party. Make this decision with legal counsel, your insurer and law enforcement guidance. Many organisations recover from backups without paying.
What not to do
- Don’t wipe or reinstall before capturing evidence.
- Don’t communicate with attackers from your own email or network.
- Don’t discuss the incident on systems the attacker may be watching.
- Don’t reconnect systems until they are verified clean.
Prepare before it happens
Keep offline or immutable backups, test restores, maintain an incident response plan with phone numbers, enforce MFA, and know who you would call.
How a ransomware attack usually unfolds
Understanding the sequence helps you recognise where you are in an incident. Most modern attacks are not a single event but a staged intrusion that can last days or weeks before the ransom note appears.
- Initial access: phishing, stolen or guessed credentials, an exposed remote desktop or VPN, or an unpatched internet-facing system.
- Foothold and discovery: the attacker installs tools, maps the network and finds valuable systems and backups.
- Privilege escalation: they steal administrator credentials and gain control of the directory.
- Data theft: sensitive data is copied out, creating a second extortion lever (“double extortion”).
- Defence evasion: security tools are disabled and backups are deleted or encrypted.
- Encryption and ransom: ransomware is deployed broadly, often at night or on a weekend.
Because the encryption is the last step, the attacker may already have been inside for some time. That is why you must assume your credentials and environment are compromised, not just the machines that show a ransom note.
Who does what: an incident team in a small company
| Role | Responsibility |
|---|---|
| Incident lead | Makes decisions, keeps a timeline, coordinates all workstreams |
| Technical lead | Directs containment and recovery with the responders |
| Legal counsel | Advises on privilege, notification duties, regulators and payment questions |
| Communications lead | Controls internal and external messaging |
| Executive sponsor | Approves spend and business trade-offs such as extended downtime |
| HR and operations | Manage staff instructions, manual work-arounds and customer commitments |
Communication: what to say and what to avoid
Poor communication in the first day creates as much damage as the attack. Use one channel the attackers cannot see, such as a phone bridge or a fresh account on a separate platform, because corporate email and chat may be monitored.
- Staff: tell them which systems are off limits, how to work manually, who to contact and not to speak publicly about the incident.
- Customers and partners: be factual, say what you know, what you do not yet know and when you will update them. Avoid speculation about cause or data loss until it is confirmed.
- Regulators and insurers: follow your counsel’s advice and policy conditions on timing and content.
- Media: use a short holding statement approved by counsel; do not improvise.
Recovery priorities
Rebuild in an order that restores the business, not just the servers. A typical sequence is:
- Identity infrastructure (directory services and authentication), rebuilt or verified clean
- Core network services (DNS, DHCP) and security tooling
- Systems that support life-safety, payroll and cash collection
- Customer-facing and revenue-generating systems
- Collaboration tools and remaining business applications
Restore from backups taken before the earliest evidence of compromise, scan restored systems before reconnecting and reset all credentials, including service accounts and API keys, once you are confident the attacker has been removed.
After the incident: lessons that stick
- Hold a blameless post-incident review within two weeks, covering root cause, detection gaps and decision quality.
- Close the entry point and the paths that enabled spread: MFA gaps, flat networks, over-privileged accounts and unpatched systems.
- Update the incident response plan, contact lists and backup strategy.
- Consider continuous monitoring so the next intrusion is spotted at the foothold stage.
Ransomware readiness checklist
| Control | Question to ask |
|---|---|
| Backups | Do we have offline or immutable copies, and have we tested a full restore? |
| MFA | Is it enforced on email, VPN and every admin account? |
| Patching | Are internet-facing systems patched within days of critical fixes? |
| Endpoint detection | Is EDR on every server and laptop, and is someone watching alerts? |
| Privileged access | How many domain admins exist, and are they used for daily work? |
| Network segmentation | Can one infected laptop reach the backup console? |
| Response plan | Is there a printed copy with phone numbers, and have we practised? |
| Insurance | Do we know the policy conditions, panel vendors and the hotline number? |
Decisions leaders have to make in the first day
Technical teams will focus on containment, but several decisions belong to leadership, and they are easier to make well if you have thought about them in advance. The first is whether to take systems offline deliberately. Shutting down affected networks or business applications limits spread and protects backups, but it also halts operations, so someone with authority must weigh the trade-off. The second is when and how to involve outside parties: your insurer, an incident response firm, outside counsel and law enforcement. Many insurance policies require notification within a short period and approval of vendors before you incur costs, so a delay of even a day can create coverage problems.
The third decision is how to handle communication with the attackers, if at all. Do not contact them yourself. Professional negotiators, working under counsel, sometimes engage to verify what data was taken, to buy time or to confirm that decryption would work, but this is a specialist activity with legal implications. The fourth is what to tell customers, employees and regulators and when. Statements made too early can be inaccurate; statements made too late can breach contracts or law. A good compromise is a brief, factual holding statement followed by regular updates as facts are confirmed.
Protecting people during an incident
A long incident is exhausting. The responders and IT staff who work through the night are the same people you need functioning on day three. Plan shifts, make sure people eat and rest, and protect them from constant interruptions by routing questions through the incident lead. Be honest with staff about what is happening and what is expected of them, and avoid blame while the incident is live. Organisations that handle this well recover faster, because decisions stay clear-headed and people remain willing to report mistakes quickly.
The 3-2-1-1-0 backup rule and why it matters
Backups decide whether ransomware is an expensive inconvenience or an existential crisis, and attackers know it. They look for backup consoles, delete snapshots and encrypt network shares that hold copies. A modern rule of thumb is 3-2-1-1-0: keep three copies of your data, on two different types of media, with one copy offsite, one copy offline or immutable and zero errors verified by regular restore testing. Immutable storage, where data cannot be altered or deleted for a set period even by an administrator, is one of the most effective controls available. Separate the credentials for backup systems from your main directory, require MFA for backup administration and test restoring a complete server, not just a few files, at least twice a year. Record how long a realistic recovery takes, because that number is what leadership needs to decide whether paying could ever make sense.
Legal, insurance and regulatory dimensions
A ransomware attack is also a legal event. If personal data was accessed or exfiltrated, you may have duties under state breach laws, HIPAA, GDPR or contractual terms, each with its own definitions and deadlines. Working through counsel helps keep investigative findings privileged and ensures notifications are accurate and timely. Your cyber insurance policy may cover forensic investigation, legal costs, notification, business interruption and extortion payments, but usually only if you follow notice and consent conditions. Some jurisdictions and sectors impose reporting duties to regulators or law enforcement within short windows, for example for critical infrastructure operators, so identify these obligations in advance. Payments to sanctioned groups can violate sanctions laws, which is why checking the identity of the threat actor is part of any payment decision.
Working with law enforcement
Many organisations hesitate to involve law enforcement because they fear delays or publicity. In practice, agencies such as the FBI and CISA can provide technical indicators, sometimes decryption keys or insights about the group involved, and a record that may help with insurance and regulatory conversations. Reports can generally be made confidentially, and responders are used to coordinating with private incident response teams. Provide them with the ransom note, any contact details and wallet addresses, sample encrypted files and relevant logs, and follow their guidance about communications with the attackers.
Myths that lead to bad decisions
- “Paying will fix everything.” Decryptors can be slow or incomplete, and you will still have to rebuild and secure systems.
- “They only hit big companies.” Criminals target any organisation that cannot afford downtime, including small clinics, schools and local governments.
- “Antivirus will stop it.” Many attacks use legitimate tools and stolen credentials that traditional antivirus does not flag.
- “Cloud services are immune.” Cloud accounts can be taken over and data deleted or encrypted just like on-premises systems.
- “Once restored, we are done.” Without finding and closing the entry point, attackers frequently return.
Frequently Asked Questions
Should I turn off infected computers?
Isolate them from the network but leave them powered on if you can, so volatile evidence is preserved. Follow your incident responder’s advice.
Can we recover without paying?
Often yes, if you have clean, tested backups. Recovery time depends on how well you prepared.
Do we have to report the attack?
Possibly. Requirements depend on your industry, location and the data involved. Ask counsel immediately.
How long does it take to recover from ransomware?
It varies widely: from a few days for well-prepared organisations with clean backups to several weeks or longer for those that must rebuild their environment. Preparation is the biggest factor.
Will the attackers leak our data even if we pay?
There is no guarantee. Payment does not ensure data is deleted, and some groups have extorted victims again. This is why legal and law enforcement advice matters.
Does cyber insurance cover ransomware?
Many policies cover incident response costs, business interruption and sometimes extortion payments, subject to conditions and exclusions. Read your policy and call the claims hotline early.
Want a plan in place before a crisis?
We build and test incident response plans and provide detection and response. Explore our threat detection and response services →
