Understanding the Critical Window
The first 24 hours after discovering a ransomware attack are crucial. Your immediate actions determine whether data can be recovered, how much operational damage occurs, and whether attackers gain additional leverage. Panic and rushed decisions often make situations worse, which is why having a pre-planned response is essential.
Hour 0–1: Immediate Detection and Containment
When ransomware is detected:
- Isolate affected systems immediately: disconnect from network, power off if necessary
- Don't pay attention to on-screen messages: ransom notes contain lies and psychological pressure
- Notify your incident response team: or IT leadership immediately
- Document the discovery: screenshot ransom notes, record time, note which systems show symptoms
- Preserve evidence: don't delete files or clear logs — these help forensics
- Assess scope: determine which systems are affected, which are still clean
- Activate your incident response plan: contact predetermined team members
Hour 1–3: Investigation and Communication
- Identify patient zero — which system was compromised first and how it spread
- Check backup systems — are they still accessible and unencrypted?
- Review recent access logs for unauthorized login attempts or suspicious activity
- Scan unaffected systems to ensure ransomware hasn't spread further
- Prepare internal communication for leadership about situation and impact
- Assess business impact — which critical operations are affected, and operational loss per hour
- Determine your contact strategy for internal and external notification
Hour 3–6: Law Enforcement and Professional Response
- Contact law enforcement and file reports with cybercrime units
- Engage cyber insurance provider — delays can void coverage
- Consider forensic specialists / professional incident response teams
- Don't attempt to decrypt files yourself — this often causes additional damage
- Document everything in a detailed action timeline
- Prepare stakeholder communication for customers, partners and employees
- Secure your communication channels using clean devices
Hour 6–12: Recovery Planning and Employee Communication
- Brief your team on the situation and what to expect
- Assess recovery options: clean-backup restore, rebuild, or selective recovery
- Prioritize recovery — which systems are most critical to business continuity?
- Establish alternative operations to keep the business running
- Provide clear employee guidance on what to do and avoid
- Monitor for further compromise and signs of lateral movement
Hour 12–24: Notification and Ongoing Response
- Notify affected parties — prepare customer notification letters if needed
- Review regulatory requirements for mandated notification timelines
- Prepare a public statement if the incident requires press communication
- Establish realistic recovery timeline estimates
- Continue monitoring — ransomware actors often maintain access for re-extortion
- Preserve forensic evidence for analysis
- Document lessons learned for after recovery
Critical Decisions to Make
Should You Pay the Ransom?
Most security experts and law enforcement recommend against payment. Paying doesn't guarantee file recovery, funds criminal operations, may attract repeated attacks, raises legal issues in some jurisdictions, doesn't guarantee a working decryption key, and attackers may demand additional payments.
Should You Negotiate?
Some organizations attempt negotiation to reduce demands, but this legitimizes the criminal relationship, is typically discouraged by law enforcement, and your cyber insurance may prohibit or limit it.
What About Restoring from Backups?
- If you have clean backups, restore systematically after security investigation
- Verify backup cleanliness — ransomware may have infected backups days before encryption
- Restore incrementally — don't restore everything at once; watch for reinfection
- Update security before restoring — patch vulnerabilities that enabled the attack
Communication Strategy During Recovery
Internal: be transparent with employees about impact, provide clear instructions on available systems, and update regularly on progress.
Customer: inform if their data was affected, explain what was potentially exposed, provide recommended actions (password changes, credit monitoring), and offer compensation or service credits if appropriate.
External stakeholders: inform business partners, vendors, and prepare for regulatory inquiries.
Avoiding Reinfection
- Find the infection vector — how did ransomware enter your network?
- Close the entry point — patch vulnerabilities, revoke compromised credentials
- Implement enhanced monitoring for similar attack patterns
- Segment network to prevent lateral movement if reinfection occurs
- Monitor dark web for sales of your data or access credentials
Investigation and Forensics
Engage forensic specialists to determine the initial entry point and date, dwell time, what data was accessed or exfiltrated, and whether double extortion occurred. Preserve evidence for potential law enforcement action and identify indicators of compromise (IOCs) to share with the security community.
Legal and Compliance Obligations
- Notification laws — most jurisdictions require notification within set timeframes
- Regulatory reporting under GDPR, HIPAA, and others
- Maintain detailed incident documentation for potential litigation
- Work with insurance company on claim requirements
- Don't destroy evidence prematurely
Post-Recovery Phase (Day 2+)
- Strengthen security posture with controls that would have prevented this attack
- Conduct a security audit and address all vulnerabilities
- Update incident response plan based on what worked and what didn't
- Reinforce employee security awareness with lessons learned
- Evaluate vendor security for third-party tools and services
- Continue monitoring for compromise indicators
