Ransomware Response: The First 24 Hours

Key takeaways

• Contain first, decide later. The payment question cannot be answered until you know the scope, the backup state, and the exposure, all three of which take hours to establish honestly.
• Isolate, do not power off. Volatile data on encrypted systems is evidence, and "we reimaged it" is the answer that damages the investigation, the insurance claim, and the regulator report at once.
• Check backups before you check the ransom demand. The most common recovery path is not payment, and knowing what is restorable changes the entire negotiating position.
• The clocks started already. GDPR, HIPAA, state laws, and for listed companies Item 1.05 disclosure all key off discovery, not off your incident review.
• If you talk to the attacker, talk through a professional. Direct amateur contact raises prices and lowers options. The negotiation guide explains why the first number they give you is never the real number.

Hours zero to four: stop the spread

1. Isolate at the network level. Disconnect affected segments, disable compromised accounts, block the command-and-control addresses. If your platform allows it, snapshot encrypted machines before doing anything else.
2. Do not power off, reimage, or restore yet. The evidence requirements of your claim and any regulatory defense are decided in these hours.
3. Identify the variant. Ransomware families carry known behaviors, known flaws, and occasionally known decryptors; identification changes recovery options immediately.
4. Check your offline, immutable backups first. The single most important question in hour two: what exists that the attacker could not reach?

Hours four to twelve: know what you lost

• Scope the encryption and the exfiltration separately. Modern ransomware is a two-part event: systems locked, data stolen. The stolen data, not the locked systems, usually drives notification obligations and the true exposure.
• Preserve the ransom note and any attacker infrastructure. For the investigation and the negotiation record, these carry version and timeline data.
• Engage the response path: carrier hotline, counsel, and a responder who knows ransomware, chosen fast and right. If you carry cyber insurance, panel firms can usually start under the claim immediately.
• Brief leadership on facts, not fears. The incident commander runs the breach response checklist; the board gets a factual update with knowns and unknowns.

Hours twelve to twenty-four: the decision inputs

The payment decision is made on evidence, and the inputs are all establishable within a day:

1. Recoverability. What do working backups cover, and what downtime gap remains?
2. Exposure. What was stolen, whose data is it, and what do notification laws require you to tell, and when?
3. Negotiation posture. Attackers price to perceived ability to pay and urgency; the first demand is an opening position, not a finding. The negotiation guide covers the mechanics, the psychology, and what a professional negotiator changes.
4. Sanctions screening. Payments to sanctioned actors or wallets are illegal regardless of the incident; this check is mandatory before any payment conversation advances.

Only after these inputs exist does the business make the payment, partial recovery, or full-recovery call, with counsel in the room and the decision documented.

What not to do

• Do not pay in the first hours. Early payment is the most expensive version of every ransom; you have not established scope, you have not checked backups, and you have shown maximum fear at maximum urgency.
• Do not let IT "clean up" before forensics. Restoration before imaging destroys the record of both the attack and the exfiltration.
• Do not email the attacker from your own mailbox. It identifies decision-makers, signals urgency, and locks you into a bad anchor. Professional negotiation exists precisely to not do this.
• Do not promise the board a number. The cost estimate of hour four is never the cost of hour twenty-four; keep the briefing factual.

The week after

Containment stable, decision documented, recovery underway: the incident now feeds the post-incident review, the notification filings, and the claim. The review is where you convert this into preparation: the response plan, the tabletop exercise that rehearses it, and the retainer decision with known pricing, so the next first-24-hours runs on muscle memory instead of adrenaline.

Frequently asked questions

Should you ever pay a ransomware ransom? Sometimes, but only as a documented business decision after the inputs exist: backup state, exfiltration exposure, sanctions screening, and a professional negotiation posture. Paying early is the most expensive version; paying without counsel is the riskiest. The negotiation guide covers how the decision is made when it is made.

Does cyber insurance cover the ransom payment? Many policies cover ransom and response costs, but the panel rules matter: engage the hotline first, because off-panel engagement without pre-approval can turn a covered incident into an uncovered one (the overlap explained).

How fast does ransomware spread after encryption starts? Modern strains move laterally in hours and often finish a network before detection, which is why the first moves are isolation and scope, and why the exfiltration question matters as much as the encryption question.

What do ransomware attackers do with stolen data? Exfiltrated data drives the second extortion (leak sites), the notification obligations, and often the regulatory exposure, so scoping the theft is a first-24-hours job, not a later-phase one.