The businesses that survive ransomware aren't the ones with the smartest people in the moment — they're the ones who decided what to do before the moment arrived. Here's what the first hour should look like.
Nobody thinks clearly during a crisis. The businesses that survive a ransomware attack aren't the ones with the smartest people in the moment — they're the ones who decided what to do before the moment arrived.
If ransomware hit your business tomorrow, the first hour is what determines whether it's a bad week or a catastrophic quarter. Here's what that hour should look like.
Minute 0–10: Isolate, don't panic
The first instinct when something looks wrong is often the wrong one. The right first move is to isolate, not to power off.
- Disconnect the affected device from the network — pull the network cable, turn off Wi-Fi. This stops the ransomware from spreading to other machines in real time.
- Don't shut the machine down. Powering off can destroy evidence in memory and sometimes triggers destructive behavior. Leave it running, isolated.
- Don't start paying. Don't engage the attacker. Don't click the ransom note's links. Every action you take now is evidence later.
The goal of the first ten minutes is containment, not resolution. Slow is fast here.
Minute 10–30: Assess and preserve
Once the bleeding is slowed, figure out what's happening:
- What's encrypted? Which machines, which shares, which systems.
- What's the scope? Is it one device, a department, or the whole environment?
- What's still safe? Identify what the attacker hasn't reached — especially your backups.
Preserve evidence: photograph the ransom note, note the time, and don't let anyone start "fixing" things in a way that overwrites logs. The timeline you keep now is what investigators and insurers will need.
Minute 30–60: Notify the right people
This is where having a plan pays off. In the first hour, you should be calling:
- Your IT provider or incident lead — someone who can coordinate the technical response.
- Leadership — one decision-maker who can authorize spending and communication.
- Legal and insurance — if you have cyber insurance, notify them early; many policies require it and some provide an immediate response team.
- Law enforcement — a report to authorities (FBI/IC3 in the US, or local equivalent) is often expected and sometimes required.
What you should not do in the first hour: email the whole company, post publicly, or talk to the attacker. Communication in a breach is a discipline, not a reaction.
The decision that can't wait: restore vs. recover
Fairly early, you'll face the central question: do we restore from backups, or do we consider paying?
The answer should already be made. If your backups are tested and offline, you restore — clean, confident, and without funding criminals. If they aren't, the decision becomes a desperate negotiation under pressure, which is exactly how attackers want it.
This is why the backup work you do the year before matters more than anything you do in the hour itself.
Build the plan before you need it
The first hour is too late to design the first hour. Write it down: who isolates, who assesses, who calls whom, in what order, with what numbers. Keep it where someone can find it when the person who wrote it is on vacation — because that's usually when it happens.
A one-page incident response plan, rehearsed once a year, is the difference between a contained incident and a business-defining disaster.
Want help building that one page before you need it? Book a strategy call and we'll write it with you.