Incident Response
Ransomware: the decisions of the first hours
The first hours of a ransomware attack shape how long the outage lasts and how good the investigation will be. The right reflexes, and the ones to avoid.
When the first encrypted files appear, the pressure is immediate: leadership wants a recovery date, IT wants to restart everything, and the insurer asks for a claim number. Decisions made in those first hours weigh heavily on what follows.
1. Isolate, don't power off
The first reflex is often to shut down the affected servers. It is understandable, but it wipes the memory, which sometimes holds keys, malicious processes and the attacker's active connections.
It is better to isolate: cut network access to the affected machines (through the EDR, switches or firewall) while leaving them running until a memory capture has been taken.
2. Cut off the attacker's access
Ransomware is almost always the last stage of an intrusion that began days or even weeks earlier. As long as the attacker's access remains open, restoring simply hands them a clean environment.
Usual priorities:
- disable known compromised accounts and revoke their sessions and tokens, including in M365 or Entra ID;
- shut down non-essential remote access (VPN, exposed remote desktops, remote support tools);
- keep a close eye on privileged accounts and domain controllers.
3. Preserve the evidence
The investigation will answer three questions: how the attacker got in, what they did, and what data they may have exfiltrated. Without evidence, those answers remain guesses, which complicates discussions with your insurer and your notification obligations.
Before cleaning or reinstalling anything, keep the logs (firewall, VPN, EDR, Active Directory, M365), memory captures and images of key systems. Chain of custody matters.
4. Check backups before using them
Attackers target backups first. Before restoring, you need to know whether they are intact and, above all, whether they are clean: a backup taken after the initial intrusion may contain the attacker's backdoors.
5. Organize communication
Quickly appoint a crisis lead, a communication channel outside the compromised systems, and a cadence for status updates. Notify your insurer early: many policies impose deadlines and approved providers.
What to avoid
- Negotiating or paying alone, without legal advice or your insurer's input.
- Reinstalling servers before understanding the entry point.
- Communicating publicly about the scale of the incident before you know it.
Prepare before it happens
These decisions are much easier when they have been thought through calmly beforehand. An incident response plan and a ransomware playbook, tested during a tabletop exercise, mean you know who decides what on the day it really counts.