Ransomware response: what to do in the first 24 hours (a checklist you can print)

Nobody reads a ransomware playbook for the first time during a ransomware attack and does well. Screens are locked, people are panicking, the phone is ringing, and every decision feels like it has to be made immediately.

That's exactly why this checklist exists. It's meant to be printed, kept somewhere that doesn't depend on your network being up, and rehearsed before you need it. The order matters: what you do in the first few hours shapes everything after.

Hour 0 to 1: contain

The goal is to stop the encryption from spreading, without destroying evidence.

• Isolate affected systems from the network. Unplug the network cable, disable Wi-Fi, or use your endpoint security tool to quarantine the host. Don't just shut machines down by reflex — powering off can lose volatile evidence such as what was in memory, and your investigators may want it. Follow your plan's guidance on this.
• Disable compromised accounts and, where you can, restrict privileged accounts that may be in the attacker's hands.
• Protect your backups immediately. Attackers routinely hunt for backups first. Disconnect backup systems from the network and confirm which copies are offline or immutable.
• Don't wipe or reimage yet. You'll want to understand what happened before you erase it.

Hour 1 to 4: activate and preserve

• Declare an incident and activate your incident response plan. Name an incident commander so decisions have one owner.
• Assemble the team: IT and security, legal, communications, executive leadership, and HR if staff data may be involved. Use an out-of-band channel — a phone bridge, a personal messaging group — if your normal systems may be compromised, since the attacker may be reading your email.
• Start a log. Record every action with a time and name: what was found, what was done, who decided. This is invaluable for investigation, insurance, and legal review.
• Preserve evidence: screenshots of ransom notes, ransom note files, sample encrypted files, relevant logs, and a forensic image of affected systems where feasible.
• Bring in outside help early if you have an incident response retainer or cyber insurance. Many insurers require you to notify them promptly and use approved responders, so check your policy.

Hour 4 to 12: assess

Work out the shape of the problem:

• Which systems and data are affected? Is it one department or the domain?
• How did they get in? Common entry points include phishing, exposed remote access, unpatched internet-facing systems, and stolen credentials.
• Is the attacker still present? Look for new accounts, scheduled tasks, remote-access tools, and persistence mechanisms. Cleaning up the encryption while leaving the intruder in place invites a second round.
• Was data stolen as well? Many ransomware groups now steal data before encrypting, then threaten to publish it. This changes your legal and notification obligations significantly.

Hour 12 to 24: communicate and decide

Legal and regulatory. Involve counsel early. Depending on your jurisdiction and the data involved, you may have mandatory notification duties to regulators, customers, or both, often on tight deadlines. Law enforcement agencies, such as the FBI and CISA in the US, or the relevant national cyber agency elsewhere, accept ransomware reports and can sometimes help.

Internal communication. Tell staff what's happening and what to do — and what not to do, such as using personal accounts to work around outages. Silence breeds rumor.

External communication. Prepare factual, plain statements for customers and partners. Don't speculate about causes you haven't confirmed.

The ransom question. This is a business, legal, and ethical decision, not a technical one, and it shouldn't be made in the first panicked hours. Authorities generally advise against paying: there's no guarantee of recovery, it funds further attacks, and payments to sanctioned groups can create legal exposure. Your decision should be made with legal counsel and informed by whether clean backups exist.

Recovery, in the days that follow

1. Eradicate the attacker's access first. Reset credentials broadly — especially privileged and service accounts — and close the entry point.
2. Restore from known-clean backups, verified before reconnecting. Rebuild systems you can't trust rather than cleaning them in place.
3. Restore in priority order, starting with the systems the business depends on most.
4. Monitor closely for signs of reinfection as systems return.
5. Hold a blameless review afterward, and update the plan with what you learned.

What to prepare before you need it

The best response is mostly built in advance:

• Backups that survive an attack: offline or immutable copies, tested restores, and a clear idea of how long a full restore actually takes.
• MFA everywhere it matters, especially remote access and administrator accounts.
• Patching of internet-facing systems, and an inventory of what's exposed.
• Network segmentation so one compromised machine can't reach everything.
• Endpoint detection and response and centralized logging, so you can see what happened.
• A written, printed plan with contact details for your response team, insurer, counsel, and authorities.
• Tabletop exercises. Walk the leadership team through a realistic scenario at least once a year. The gaps you find on paper cost nothing; the ones you find during a real incident cost a great deal.

Practice turns a plan into a reflex

The difference between a plan and a capability is rehearsal. Our Ransomware Preparedness and Response course runs teams through a realistic scenario using exactly this sequence, and our Incident Response and Threat Hunting program goes deeper for security staff. Prevention starts with people too — see how to spot a phishing email — and with your recovery design, covered in our Disaster Recovery and Business Continuity in the Cloud course.