Ransomware Recovery: What To Do in the First 24 Hours
A practical hour-by-hour guide for SME leaders, from first alert through to a controlled recovery path.
The first 24 hours of a ransomware incident set the trajectory of the entire recovery. Good decisions early shorten the outage, reduce the cost and protect the relationships that matter. Bad decisions early can extend the damage by weeks.
First hour: contain
Isolate affected systems from the network. Do not power them off. Convene the response team. Start a written log of every action and every decision, with timestamps. Notify your insurer if you have a policy.
Hours 2 to 6: assess
Identify the scope. What is encrypted, what is intact, what is exfiltrated. Engage your incident response partner. Resist the urge to start rebuilding before you understand what happened.
Hours 6 to 12: decide
Decide the recovery path. Restore from clean backups if you can. Engage specialist negotiators if a ransom decision is genuinely on the table, and never negotiate directly. Begin stakeholder communications.
Hours 12 to 24: recover
Bring critical systems back in a controlled sequence, into a hardened environment, not back into the compromised one. Continue logging every decision. Plan the customer and ICO communications carefully.
What not to do
Do not pay the ransom without expert advice. Do not wipe systems before forensics. Do not announce recovery before you are confident the attacker is no longer in the network.
Frequently asked questions
Should we ever pay the ransom?+
Sometimes the answer is unavoidable, but it should always be the last option and always with expert advice. Paying does not guarantee recovery and increases the chance of repeat attacks.
Do we need to tell the ICO?+
If personal data has been affected and the breach is likely to result in a risk to individuals, you must notify the ICO within 72 hours of becoming aware.
Will our insurer pay?+
Only if you meet the policy conditions. Document everything from minute one.
Next step
Want to talk this through?
Book a free 30 minute consultation. No sales pitch, just clear answers.
Book free consultation