Ransomware Recovery: What To Do in the First 24 Hours
By Daniel Agyemang Prempeh, Founder, DefendVistaLast reviewed:
A practical hour by hour guide for SME leaders, from first alert through to a controlled recovery path, with the mistakes that turn a bad day into a bad year.
The first 24 hours of a ransomware incident set the trajectory of the entire recovery. Good decisions early shorten the outage, reduce the cost and protect the customer relationships that took years to build. Bad decisions in the first six hours can extend the damage by weeks and turn a recoverable incident into the kind that ends businesses. This guide outlines an illustrative response sequence, not a client engagement or a guaranteed recovery timetable.
Hour zero: detect and declare
Most ransomware is discovered by a staff member who cannot open their files, or by the morning shift arriving to a printer spitting ransom notes. The first decision is whether this is genuinely an incident. Duty manager declares, the incident response plan comes out of the safe, and the response team is convened on the out of band channel (not Teams, because Teams may be compromised). Start the written log: every action, every decision, with timestamps. The log will matter to the insurer, the ICO and any later litigation.
First hour: contain, do not destroy
Isolate affected systems from the network by pulling cables or disabling switch ports. Do not power systems off: memory contents are forensically valuable and powering off can destroy evidence about how the attacker got in. Disable VPN and remote access at the perimeter to prevent further attacker movement. Notify your cyber insurer now: most policies require notification within hours and unauthorised remediation can void cover.
Hours 2 to 6: assess the scope
Identify what is encrypted, what is intact, and critically what has been exfiltrated before encryption (modern ransomware groups almost always steal data first to use as leverage). Engage your incident response partner if you have a retainer, or activate one now if you do not. Resist the very strong urge to start rebuilding before you understand what happened. Premature rebuild is the single most common reason for reinfection within 72 hours.
Hours 6 to 12: decide the recovery path
Assess clean backups, rebuild options and operational priorities with your incident lead and specialists. Verify backup integrity before restoration and obtain legal advice before considering ransom payments. Assess each personal-data breach. Notify the ICO without undue delay and, where feasible, within 72 hours of awareness unless it is unlikely to result in a risk to individuals' rights and freedoms. Notify individuals without undue delay where there is a high risk. Document the breach and your assessment.
Hours 12 to 24: controlled recovery
Bring critical systems back in a controlled sequence into a hardened environment, never back into the compromised one. This usually means a fresh Active Directory, new admin credentials for every privileged account, EDR deployed on every machine before it touches the network, and validated patching. Continue logging every decision. Communications to customers, staff and (if a public statement is needed) the press are handled by a small named group, not ad hoc by whoever picks up the phone.
What not to do
Do not pay the ransom without expert legal and forensic advice (and never without checking sanctions exposure: payments to OFAC or HMT listed groups are illegal). Do not wipe systems before forensics. Do not announce recovery before you are confident the attacker is genuinely no longer in the network. Do not let well meaning IT staff start cleaning machines before the incident response partner has triaged them. Do not communicate sensitive information on the same email system that may still be compromised.
An illustrative worked example
Illustrative scenario. This is a hypothetical sequence used to show what a well run response looks like. It is not a DefendVista client engagement and no figures are claimed as outcomes. Ransomware is detected by the morning shift when run sheets fail to print. The duty manager declares an incident within minutes, the incident response partner is activated and the insurer is notified the same morning. Paper run sheets go out so dispatch keeps moving manually. Backup integrity is confirmed before any restore begins, and ICO notification is prepared where driver personal data is in scope. Critical systems are restored into a hardened environment rather than the compromised one. The difference from a worst case scenario is a tested plan, an active retainer and a calm duty manager who follows the playbook.
Frequently asked questions
Should we ever pay the ransom?+
Sometimes unavoidable, always last resort, always with specialist legal and forensic advice. Payments to sanctioned actors are illegal in the UK. Paying does not guarantee decryption (roughly 30 percent of paid decryptors do not work cleanly) and significantly increases the chance of being targeted again.
Do we need to tell the ICO?+
Assess each personal-data breach. Notify the ICO without undue delay and, where feasible, within 72 hours of awareness unless it is unlikely to result in a risk to individuals' rights and freedoms. Notify individuals without undue delay where there is a high risk. Document the breach and your assessment.
Will our insurer pay?+
Only if you meet the policy conditions. Document everything from minute one, follow the insurer's panel IR firm requirements, and avoid taking remediation action they have not approved. The most common reason for partial or denied claims is unilateral action by the policyholder in the first 24 hours.
How long until we are genuinely safe again?+
Operational recovery in 1 to 2 weeks. Forensic close out, root cause and remediation in 2 to 4 months. Full post incident hardening (new identity model, segmentation, supplier review) often runs 6 to 12 months.
Next step
Want to talk this through?
Book an initial call. No sales pitch, just clear answers.
Book an initial call