What to Do in the First 24 Hours After a Ransomware Attack

When ransomware hits, the first hours decide how much you lose. People panic, systems keep spreading the infection, and evidence disappears. A short, rehearsed plan beats improvisation. This guide covers what to do in the first 24 hours and what to prepare before it happens.

Hour 0 to 1: contain

• Isolate affected machines. Disconnect them from the network and Wi-Fi. Do not switch them off unless you must, because memory can hold evidence.
• Disable compromised accounts and reset privileged credentials from a clean device.
• Protect your backups. Disconnect backup systems from the network so the attacker cannot encrypt or delete them.
• Call your security provider or response team. If you have a monitored service, tell them immediately.

Hour 1 to 4: assess and preserve

• Identify what is affected: servers, endpoints, cloud accounts, email.
• Take screenshots of ransom notes and note file extensions. Do not delete anything.
• Keep logs from firewalls, endpoint tools and identity systems before they roll over.
• Find the entry point if you can: a phishing email, an exposed remote service or a stolen password.

Hour 4 to 12: decide and communicate

• Inform management and legal. Decide who speaks for the company.
• Check your reporting duties. Personal data breaches may need to be reported to the data protection authority within 72 hours under GDPR. Organisations covered by NIS2 or DORA have their own deadlines, starting with an early warning within 24 hours.
• Notify your insurer if you have cyber insurance. Many policies require early notice and approved responders.
• Tell staff what to do and, when needed, customers. Short, factual messages work best.

Hour 12 to 24: start recovery safely

• Rebuild from clean images and restore data from backups that you have checked are clean and complete.
• Bring back the most important services first and watch them closely for signs that the attacker is still present.
• Remove the attacker’s access before you reconnect. Restoring into a network that is still compromised only gets you encrypted again.

Should you pay the ransom?

Law enforcement agencies advise against it. Payment does not guarantee that you get your data back, it funds further attacks, and in some cases it may raise legal issues. The strongest answer to ransomware is a backup you can restore and a team that can detect the attack early.

Prepare before it happens

• Keep an offline or immutable backup and test restores regularly. See our backup and disaster recovery service.
• Use endpoint detection and response and multi-factor authentication so common entry points are harder to use.
• Have 24/7 monitoring so someone sees the attack at night and at weekends, when ransomware often starts.
• Write an incident response plan with names and phone numbers, and practise it once a year.

If you are dealing with an incident now, call us. If you want to be ready for the next one, book a meeting.