Nobody wants to read this article under pressure, so bookmark it now. If ransomware ever hits your business, calm, ordered action in the first 24 hours makes an enormous difference. Prevention is covered in our ransomware protection guide; this is the emergency playbook. It is built from the CISA #StopRansomware Guide's response checklist and cross-checked against incident-response write-ups from Commvault, Huntress, ManageEngine and Splashtop. Some of those are vendors with products to sell, and a few of their statistics were not verifiable, so we left them out.
Key takeaways
- Contain first: isolate affected systems, but do not power them off unless there is no alternative.
- Verify your backups before promising a recovery, and assume data may have been stolen.
- Bring in your incident response provider, cyber insurer and legal counsel early, and report the attack.
- Find and close the entry point before you restore, then rebuild from clean images.
Hour 0 to 1: Confirm and Contain
- Confirm it is ransomware. Huntress suggests looking for ransom notes, mass file-extension changes and security alerts for bulk file modification, and working out the blast radius (one computer, a file share, a domain controller).
- Isolate affected systems. CISA advises taking affected network segments offline and coordinating by phone or another out-of-band channel so attackers do not learn they have been detected. Disconnect machines from Wi-Fi, cables and VPN.
- Do not power machines off unless nothing else works. CISA calls it a last resort because it destroys volatile evidence, and Huntress adds that pulling cables or powering down can also cut your own access.
- Close access paths. Disable compromised accounts and any remote access that lacks multi-factor authentication.
- Do not wipe or reinstall anything yet. You would destroy evidence and possibly your recovery path.
Hour 1 to 4: Assess and Mobilise
- Activate your incident response plan and gather IT, leadership, legal and communications. ManageEngine recommends defined roles: decision-makers, analysts and responders.
- Locate the ransom note and the files around it. Their metadata can reveal which user account ran the attack (ManageEngine). Photograph the note and record file extensions and times. Do not engage with the attacker.
- Check Active Directory for signs of compromise, such as new privileged accounts, locked-out users or unexpected changes to groups.
- Assume data was stolen. Huntress advises hunting for unusual outbound traffic to cloud storage or tunnelling tools, and bringing in legal counsel, because what left the network drives notification duties.
- Take system images and memory captures for investigators, as CISA's checklist suggests.
Hour 4 to 8: Protect Your Backups and Notify
- Verify backups before promising recovery. Confirm they are offline or immutable, untouched and actually restorable. Commvault and Huntress both warn that attackers increasingly target backups and shadow copies, and that restoring from a backup the attacker already touched reinfects everything.
- Notify. CISA lists leadership, your cyber insurer and authorities such as CISA, the FBI and IC3. Splashtop suggests contacting the insurer early. Take legal advice about breach-notification obligations, since the sources disagree on deadlines: some cite 24 hours, others 72 hours for critical infrastructure. Check the rules for your region and sector.
- Prepare a short, honest holding statement for staff and customers.
Hour 8 to 24: Investigate and Plan Recovery
- Find the entry point. ManageEngine lists the usual suspects: phishing, malicious attachments, drive-by downloads and unpatched software. Check email, proxy and firewall logs. Huntress insists on root cause before rebuilding: which account, whether MFA was bypassed and which systems it touched.
- Hunt for persistence. CISA suggests looking for precursor malware, new privileged accounts, tampering with backups, unexpected remote-management tools and credential dumping.
- Rebuild, do not "clean". Rebuild systems from clean images, reset passwords and patch the gaps. Restore identity systems first in a clean environment, then critical services by priority.
- Restore carefully. ManageEngine advises starting restoration only after containment and the initial investigation are complete, and testing restores first.
- Document everything. Record each action, observation and message with timestamps for insurers, regulators and the post-incident review.
About Paying the Ransom
Authorities generally advise against paying. Splashtop notes that payment does not guarantee recovery, and Commvault urges extreme caution and legal counsel before any contact with attackers. In practice it is a business and legal decision, not something to decide in a panic in the first hours.
After the Crisis: Learn and Harden
- Hold a post-incident review: what happened, what worked and what did not. Update your plan and rehearse it twice a year.
- Add phishing-resistant multi-factor authentication, tested offline backups and automated patching.
- Share indicators of compromise with CISA or your industry sharing group, as CISA's checklist suggests.
- Review the broader risks in cybersecurity threats for small business, and strengthen sign-in with passkeys.
Get Help Early
The sooner an expert is involved, the more you can save. If you need help securing your web applications, servers or cloud environment after an incident, contact Node-devs.
References and further reading
This guide was compiled from the sources below. We compared them, kept the points they agree on and wrote the article in our own words. Check the originals for more detail.
- #StopRansomware Guide (CISA)
- Ransomware attack: your first 24 hours are critical (Commvault)
- The first 24 hours: what actually happens when ransomware lands (Huntress)
- Ransomware incident response plan (ManageEngine)
- Ransomware protection for small business (Splashtop)
