Contents
It usually starts with a phone call. A file server shows strange extensions, the accounting system will not open, a note on a screen asks for money. What the company does in the next few hours decides whether it loses a day or a month.
Ransomware is not rare. It was part of 48% of all breaches in Verizon’s 2026 report. And attackers move fast: Mandiant found that the time from the first break-in to handing the access over to another criminal group fell to 22 seconds.
The first hour: stop the spread
Disconnect, do not switch off. Pull the network cable, turn off Wi-Fi, disconnect the affected machines from the network. If many systems are hit, take the network down at the switch. Power a machine off only if you cannot disconnect it: shutting down erases evidence that investigators need.
Name one person in charge. One lead decides, everyone else reports to them. In a serious attack the CEO usually leads, with IT running the technical work.
Move to a channel the attacker cannot see. If email or chat runs on the affected systems, assume the attacker can read it. Use phones and a separate messenger group set up for this.
Start a log. One document with the time of every finding, decision and action. You will need it for the regulator, the insurer and the investigation.
The next three hours: understand and protect
Find out what is hit and what is not. List the systems in order of importance for the business and mark each one: affected, clean, unknown.
Protect the backups. Attackers go after them on purpose. In Sophos’s 2024 data, criminals tried to compromise backups in 94% of attacks and succeeded in 57% of those. Disconnect the backup system, change its admin passwords and do not restore anything yet.
Close the door they came in through. Turn off VPN and remote access until you know which account or system was used. Look for new administrator accounts and tools that do not belong.
Call for help. Your IT partner or an incident response team, your cyber insurer (many policies require it within hours) and the police cyber unit. In the EU, also check your reporting deadlines.
The first day: decide how to recover
Check the backups before you restore. When were they taken, are they complete, are they clean? A restore from an infected copy brings the attacker back. Investigate first, then restore.
Restore in order of importance. The systems that earn money and serve clients first, the rest later. Rebuild from clean images, not by cleaning infected machines.
Reset passwords, administrators first. Keep the accounts you need for recovery working while you do it.
Think twice about paying. Official agencies advise against it. Paying does not guarantee the data back, and it tells criminals you will pay again. More and more companies with working backups recover without paying: in Sophos’s 2026 survey, backups were used to recover in 66% of attacks where data was encrypted, up from 54%.
The first week: back to work and lessons
Most companies are back within a week or a month: 55% recovered within a week and 83% within a month in the Sophos survey. Use that week well:
- Bring systems back step by step and watch them closely for signs of the attacker.
- Send the reports the law requires, on time.
- Tell clients and partners what happened and what you did, before they hear it elsewhere.
- Write down what went wrong: how they got in, what slowed you down, what you will change.
Where to start, before it happens
The plan works only if it exists before the attack. Four things to do this month: write down who leads and who calls whom, keep an offline or immutable copy of the backups, test a restore, and know your reporting deadlines. A short IT review shows where you stand on each.
Sources: CISA #StopRansomware Guide; NCSC, immediate activities after a cyber attack; Sophos State of Ransomware 2026; Sophos, the impact of compromised backups (2024 data); Verizon 2026 DBIR; Mandiant M-Trends 2026.