Ransomware is not the moment the ransom note appears. By then the attacker has usually been inside for days or weeks — moving between machines, escalating privileges, and quietly finding and deleting your backups. The note is the end of their work, not the beginning.
What you do in the first 24 hours after discovering it determines almost everything that follows: whether you recover from backup or negotiate, whether your cyber insurance pays, and whether you are back in days or weeks. This is a practical sequence for that day.
The short version
- Isolate immediately, but do not power machines off — you destroy memory evidence and can corrupt partially encrypted files.
- Call your cyber insurer before you call anyone else. Using an unapproved vendor can void the claim.
- Assume credentials are compromised. Attackers have usually had domain access well before deploying the payload.
- Verify your backups are clean and actually restorable before trusting them. Modern ransomware targets backups first.
- Do not communicate over the compromised network. Attackers read email and Teams during incidents.
Work through the containment section below, then call your cyber insurance provider's incident hotline. The number is on your policy. If you have a managed IT provider with an incident retainer, call them in parallel. Do not start deleting anything.
Hour 0 to 1: contain
The goal in the first hour is narrow: stop it spreading. Nothing else matters yet.
Isolate, but do not power off
Disconnect affected machines from the network — pull the ethernet cable, disable the wireless adapter, or isolate the device through your endpoint management console if you have one. What you must not do is shut the machine down.
Powering off destroys the contents of memory, which frequently holds the encryption keys, the attacker's tooling, and the evidence your insurer and any forensics team will need. It can also leave files that were mid-encryption permanently corrupted, when they might otherwise have been recoverable. Isolate the machine and leave it running.
Disable rather than delete accounts
Disable any account you suspect is compromised, and force a sign-out of active sessions. Disabling preserves the audit trail; deleting destroys it. In Microsoft 365, revoking sessions matters as much as resetting the password, because an attacker holding a valid token can continue working after a password change until that token is revoked.
Protect the backups first
If your backups are network-attached, disconnect them now. Ransomware operators specifically hunt for backup servers and repositories before they trigger encryption, because destroying your ability to recover is what creates leverage. An immutable or genuinely offline copy is the single asset that most determines your outcome.
Move communication off the network
Assume the attacker can read your email and chat. Incident response discussions, insurer conversations, and any decision about payment should happen on out-of-band channels — personal phones, a separate messaging app, or in person. Businesses have had their negotiating position read in real time because they coordinated the response over the compromised system.
Hour 1 to 4: assess
With spread stopped, establish what actually happened. Resist the urge to start restoring — restoring into a compromised environment simply gets you encrypted again.
What to establish before restoring anything
| Question | Why it matters | Where to look |
|---|---|---|
| Which strain is it? | Determines whether a free decryptor exists and how the group behaves | Ransom note, file extensions, ID Ransomware |
| How did they get in? | If not closed, they return within days | VPN and RDP logs, email gateway, unpatched edge devices |
| How far did they spread? | Defines the rebuild scope | EDR telemetry, domain controller logs, file server timestamps |
| Was data taken? | Changes this into a breach with notification duties | Firewall egress logs, large outbound transfers |
| Are backups intact? | Determines whether payment is even a question | Backup console, immutable snapshots, offline copies |
Most ransomware groups now steal data before encrypting it, then threaten to publish. If data left your network, this is a data breach with notification obligations under California law and, for healthcare, HIPAA — regardless of whether you recover your files perfectly from backup.
Hour 4 to 12: notify, in the right order
The order here has financial consequences.
- Your cyber insurance carrier. First call, before any vendor. Most policies require pre-approved incident response firms, and engaging your own forensics or negotiation vendor can reduce or void the claim. Their hotline is generally staffed 24/7.
- Legal counsel. Engaging counsel early can bring the investigation under attorney-client privilege, and you will need advice on notification duties. Your insurer usually has panel counsel available.
- Your IT provider or internal team. In parallel with the above, for the technical work.
- Law enforcement. The FBI takes ransomware reports through IC3, and reporting does not obligate you to anything. It occasionally produces a decryption key where the group has been disrupted.
- Affected individuals and regulators. On the timeline your counsel specifies. California, HIPAA, and contractual obligations all have different clocks.
Notice that paying the ransom is not on this list as a step. It is a decision that comes later, informed by whether your backups are viable, and it should be made with counsel and your insurer rather than in the first panicked hours. We cover the insurer side of this in more detail in our guide to what cyber insurers now require.
Hour 12 to 24: recover, carefully
Restoration is not the first step of recovery. Rebuilding into an environment the attacker still has access to is the most common way businesses get hit twice in the same month.
What determines whether this takes days or weeks
Across incidents, the businesses that recover quickly have almost always done the same handful of things beforehand.
The difference is made before the incident, not during it
| Prepared | Recovery | Unprepared | Recovery |
|---|---|---|---|
| Immutable offline backups, tested | Days | Backups on the same network | Weeks, or payment |
| MFA on all remote access | Entry point often blocked entirely | Password-only VPN or RDP | Common entry route |
| EDR with recorded telemetry | Scope known in hours | Antivirus only | Scope guessed, rebuild everything |
| Documented environment | Rebuild follows a runbook | Undocumented | Rediscovery before rebuilding |
| Incident plan and insurer on file | Right calls in the right order | No plan | Claim risk, wasted hours |
The five things worth doing this quarter
If you are reading this and not currently in an incident, these are the highest-value preparations.
- Get one immutable, offline backup copy and test a restore from it. An untested backup is a hypothesis, and ransomware is where the hypothesis gets tested.
- Enforce phishing-resistant MFA on all remote access — VPN, RDP, and Microsoft 365 alike. See our guide to why SMS codes are not enough.
- Deploy EDR rather than antivirus. Signature-based tools do not catch what modern operators do. We compare the two in Defender and Intune versus legacy antivirus.
- Write a one-page incident plan. Who to call, in what order, with policy numbers and phone numbers, printed and stored somewhere that does not require the network to read.
- Review your cyber policy. Know the hotline number, the approved vendor list, and your notification window before you need them.
The short answer
Isolate without powering off. Protect the backups before anything else. Call the insurer before any vendor. Establish how they got in before restoring, and close it. Rebuild clean rather than cleaning up. And treat every credential in the environment as compromised, because it probably is.
Frequently asked questions
Should we pay the ransom?
It is a business decision, made with legal counsel and your insurer, not a technical one — and never one to make in the first hours. If you have clean, tested, offline backups, payment is usually unnecessary.
Be aware that paying does not reliably work. Decryptors supplied by attackers are often slow and incomplete, data that was stolen is not returned by decrypting your copy, and payment can carry sanctions exposure depending on the group involved. Your counsel needs to check that before any transfer.
How long do attackers usually have access before the ransom note?
Typically days to weeks. The encryption is the last stage of an operation that starts with initial access, then privilege escalation, lateral movement, reconnaissance, and data theft.
This dwell time is why "restore from backup and carry on" so often fails. Backups taken during that period can contain the attacker's tooling and persistence, and restoring them reintroduces the problem.
Will our cyber insurance cover this?
Usually, if you meet the conditions in the policy and follow the process. The two most common reasons claims are reduced are engaging an unapproved vendor before notifying the carrier, and having attested to controls on the application that were not actually in place — MFA everywhere being the frequent one.
Read your policy before an incident, particularly the notification window and the approved vendor list.
Can we just restore from backup and skip the investigation?
Not safely. Without knowing the entry point, you restore into an environment that is still accessible to the attacker. Reinfection within days is a common outcome for businesses that skip this step.
It also leaves you unable to answer whether data was stolen, which is precisely the question your regulators, clients, and insurer will ask.
Does Microsoft 365 protect us from ransomware?
It helps but does not cover it. Microsoft 365 protects its own infrastructure and offers some file recovery through version history and the recycle bin, but retention windows are short and both can be defeated by an attacker with sufficient privileges.
You still need an independent backup of Microsoft 365 data under your own control. We cover why in our post on the Microsoft 365 backup gap.
Would your business recover in days or weeks?
We will review your backup architecture, remote access, and endpoint protection against the checklist above, and give you a written summary of what would actually happen. No commitment.