Responding to ransomware: the first hours, recovery and prevention

How modern ransomware works

Ransomware is malicious software that encrypts files or systems and demands payment for the key. Most serious attacks today are run by organised groups, often using a ransomware-as-a-service model where developers rent the tools to affiliates. A typical intrusion starts with stolen credentials, an unpatched internet-facing device such as a VPN gateway, or phishing. The attackers then spend days or weeks moving through the network, gaining administrator rights, deleting or encrypting backups and copying data out. Only then do they encrypt.

Most groups use double extortion: pay to decrypt, and pay again so stolen data is not published. That means restoring from backup solves only part of the problem.

The first hours

1. Isolate affected machines from the network using EDR isolation or by unplugging network cables or disabling Wi-Fi. Avoid powering machines off if you can, because memory may hold useful evidence and sometimes keys.
2. Activate the plan: incident commander, IT, management, and your cyber insurer, who may require you to use their approved response firm.
3. Protect backups: disconnect backup systems and check whether they are intact. Change backup administrator credentials from a clean device.
4. Preserve evidence: keep the ransom note, logs, a sample of encrypted files and EDR data. Do not delete anything yet.
5. Scope: which systems, accounts and data are affected; how did they get in; is data exfiltration likely?
6. Switch to out-of-band communication: assume email and chat may be watched.

Recovery and the payment question

Recovery means rebuilding from known-good sources, not just decrypting. Prioritise critical services, reset all privileged credentials (including service accounts), close the entry point, and monitor closely as systems return. Rebuilding identity systems such as Active Directory carefully is often the critical path.

Law enforcement and national agencies such as the UK NCSC advise against paying. Whatever happens, the decision belongs to senior leadership with legal advice, not the technical team.

Reporting and prevention

Report to the police and national cyber agency, and check notification duties: if personal data is affected, UK GDPR may require notice to the Information Commissioner's Office (ICO) within 72 hours (see communication and legal duties).

Test restores regularly, keep at least one backup copy offline or immutable, and protect backup consoles with separate credentials and MFA. Most ransomware incidents exploit gaps that were known but not yet fixed.

Real-world example: ransomware at a family-run manufacturer

Early one morning, staff at a fictional furniture manufacturer find that files on the shared drive have strange extensions and a ransom note sits on every desktop. The IT manager follows the ransomware playbook: he disconnects affected machines from the network but leaves them powered on, disables the compromised admin account and calls the cyber insurer's incident line. Investigators find the attackers entered through an unpatched VPN appliance and copied some files before encrypting. The offline backups are intact, so the board decides not to pay. Systems are rebuilt and restored over four days, starting with orders and payroll. The firm reports the data theft to the regulator and notifies affected customers, then patches the VPN and adds MFA.