What Should a Business Do After a Ransomware Attack?
Written By
Sarwat Iftikhar
Ransomware now accounts for 44% of all cybersecurity breaches, a 37% year-over-year increase. The average ransomware-specific breach costs $4.91 million, and most organizations spend 24 days recovering. What separates businesses that recover in 48 hours from those still rebuilding three months later is not luck. It is the quality of the decisions made in the first hours after detection.
Most of those decisions are made under pressure, without a documented plan, and in the wrong order. Teams try to understand the attack before containing it. They wipe systems before preserving forensic evidence. They pay the ransom before exhausting alternatives. Each mistake extends the timeline, increases the cost, and in some cases eliminates the possibility of full recovery.
This guide covers what to do, in what order, and why each step matters for the speed and completeness of your recovery.
Key Takeaways
- Ransomware incidents increased 20% in the first half of 2026, with data exfiltration now occurring in 96% of attacks, turning every incident into a potential double extortion event.
- 96% of ransomware attacks target backup repositories, and 76% of those attacks successfully compromise them, meaning organizations with compromised backups face recovery costs eight times higher than those with intact ones.
- 53% of ransomware victims fully recovered within one week in 2025, up from 35% in 2024, showing that recovery maturity is improving but preparation remains the determining variable.
- The median attacker dwell time before encryption is now just four to five days, meaning attackers have typically been inside your environment for days before you see the ransom note.
- CIRCIA requires critical infrastructure entities to report ransomware payments to CISA within 24 hours. GDPR and NIS2 notification clocks begin running from the moment of discovery.
Why Do the First Hours After Ransomware Define How Well You Recover?
The first hours after ransomware detection determine whether you contain a manageable incident or allow it to become an organization-wide crisis. The ransomware payload visible on your screen is almost never the first thing the attacker did. By the time encryption triggers, the attacker has typically been inside the environment for four to five days, mapping systems, exfiltrating data, and in 96% of cases, compromising or deleting backup repositories to remove your fastest recovery option.
The decisions you make in the first two hours determine three things: how much data the attacker can still exfiltrate before access is cut, how much forensic evidence survives for the investigation, and whether recovery proceeds from clean backups or from scratch. Organizations that contain within the first two hours consistently recover faster and at lower cost than those that take hours to begin isolation.
A complete overlap exists between ransomware response and breach response in the initial phase. The containment steps, notification obligations, and evidence preservation priorities are the same regardless of which label you apply. For a structured timeline of those early-hours actions, our first 24 hours breach response guide covers the complete sequence.
What Should You Do Immediately When Ransomware Is Detected?
The immediate priority after detecting ransomware is isolation, not investigation. Isolate every affected system from the network before attempting to understand the scope or communicate with the attacker. Every minute an infected system remains connected gives the ransomware additional time to spread and the attacker additional time to exfiltrate data.
Most of the damage in a ransomware attack happens before the ransom note appears. The four-phase response framework below addresses what to do after detection, not after the encryption is noticed:
| Phase | Timeframe | Focus |
| Isolate | 0-2 hrs | Network isolation, credential revocation, evidence preservation |
| Assess | 2-8 hrs | Scope determination, backup status check, legal and IR team |
| Notify | 8-24 hrs | Regulatory filings, cyber insurer, law enforcement |
| Recover | 24-72 hrs | Eradication confirmed, clean restore begins, operations resume |
The median attacker dwell time before encryption is 4-5 days. By detection, the attacker has already moved through the environment.
The specific immediate actions in the first two hours:
Disconnect affected systems from the network. Remove network cables, disable wireless connections, and isolate affected segments through firewall rules. Do not shut down systems unless instructed by a forensic expert, since active memory may contain encryption keys, attacker credentials, or other evidence that disappears on shutdown.
Revoke and rotate all administrative credentials. The attacker almost certainly has valid credentials for multiple accounts within the environment. Revoking privileged access, resetting administrative passwords, and disabling service accounts associated with compromised systems limits their ability to maintain presence or escalate during the response.
Preserve forensic evidence before remediation. Take forensic images of affected systems before any cleanup begins. Logs, memory captures, and disk images are the foundation of the investigation and the regulatory documentation that follows. Evidence destroyed during hasty remediation cannot be reconstructed.
Alert your incident response team and legal counsel. These two groups need to be in the room from the first hours. Legal counsel shapes every subsequent decision in a way that manages regulatory exposure. The IR team drives the technical response. Both are more effective when engaged before decisions are made, not after.
Check backup integrity before assuming clean recovery is available. Attackers target backup repositories in 96% of ransomware attacks, and succeed 76% of the time. Before relying on backup restoration as the recovery path, confirm that backups are accessible, unencrypted, and were completed before the attack began.
Should You Pay the Ransomware Demand?
Paying the ransom does not guarantee data recovery, does not guarantee the attacker deletes exfiltrated data, does not remove attacker access from your environment, and in some jurisdictions may create legal exposure if the group behind the attack is a sanctioned entity. Law enforcement agencies consistently advise against payment for these reasons, but the decision is ultimately an organizational one that should involve legal counsel, cyber insurance advisors, and forensic support before being made.
The practical calculation has also changed with double extortion. In 96% of ransomware attacks, the attacker exfiltrates data before triggering encryption. Paying for a decryption key does not address the extortion leverage on that exfiltrated data, which is a separate demand that may follow regardless of whether the ransom is paid.
If payment is being considered, these are the non-negotiable checks first: confirm the attacker can actually decrypt by requesting a test decryption of a non-sensitive file before payment, consult legal counsel about sanctions exposure, notify your cyber insurer before payment since coverage may depend on the insurer’s involvement in the decision, and under CIRCIA if your organization is critical infrastructure, be aware that ransomware payments must be reported to CISA within 24 hours of payment.
Organizations with tested, isolated, immutable backups that survived the attack almost always recover faster and at lower total cost than those that pay. The investment in backup infrastructure made before the attack is what makes that option available.
How Do You Determine the Full Scope of a Ransomware Attack?
Determining the full scope of a ransomware attack requires forensic investigation of the entire environment, not just the systems displaying encryption. The systems you can see have been hit. The question is what else the attacker reached during their dwell time, which systems still have active attacker presence, and whether the exfiltration of data extended beyond the systems most visibly affected.
The specific scope questions that drive the investigation:
When did the attacker first gain access? The ransom note does not tell you when the breach began. The median dwell time of four to five days means the attacker was inside the network for days before triggering encryption. Establishing the initial access date matters for understanding what data was accessible during the entire dwell period and for accurate regulatory notification.
Which systems were accessed or encrypted? Authentication logs, endpoint telemetry, and network traffic analysis from the dwell period reveal which systems the attacker touched, which credentials were used, and how lateral movement progressed through the environment.
Was data exfiltrated and if so, what? Data loss prevention logs, network egress monitoring, and cloud storage access logs are the primary evidence sources for this question. Establishing what left the environment determines which notification obligations apply and to which affected individuals.
Are there persistent access mechanisms? Attackers frequently install backdoors, create new accounts, modify scheduled tasks, or establish command and control before triggering encryption. A recovery that closes the initial access vector while leaving persistence mechanisms active returns you to a compromised environment. Every identified persistence mechanism must be removed before restoration begins.
This investigation almost always requires external forensic expertise because the internal team managing containment and communications simultaneously cannot maintain the rigor and documentation discipline that forensic investigation requires.
What Are Your Legal and Regulatory Obligations After Ransomware?
Ransomware is not just a technical incident. It is almost always a data breach with regulatory notification obligations that run from the moment of discovery, not from the completion of the investigation. Missing notification windows are a separate regulatory violation that stacks on top of the breach itself.
Notification clocks run from the time of discovery regardless of investigation completion. Legal counsel must be involved from the first hours to ensure all applicable obligations are identified and tracked correctly:
| Framework | Deadline | Obligation |
| CIRCIA (critical infrastructure) | 24 hrs (payment) / 72 hrs (incident) | Report to CISA. Ransomware payments reported separately within 24 hours of payment |
| GDPR (EU) | 72 hours | Notify supervisory authority. Individuals if high risk |
| NIS2 (EU) | 24 hrs (early warning) + 72 hr full report | National CSIRT early warning + full incident report |
| HIPAA (US) | 60 days | Individuals, HHS, and media if 500+ in state |
Source: CIRCIA, GDPR Article 33, NIS2 Article 23, HIPAA Breach Notification Rule, 2026
The regulatory landscape for ransomware notification is stricter in 2026 than at any previous point. Beyond the frameworks above, all 50 US states maintain independent breach notification requirements with varying deadlines and definitions. Failing to notify a state regulator whose law applies because the analysis was not done promptly creates a second set of violations.
Notify your cyber insurer early in the process. Most policies require notification within a defined timeframe after discovery, and carrier involvement in recovery decisions, including the ransom payment question, may be a condition of coverage. Involving the insurer after decisions have already been made is one of the most common ways organizations inadvertently compromise their own claims. For context on how cyber insurance intersects with security testing requirements, our guide on cyber insurance and penetration testing covers the relationship in detail.
How Do You Safely Restore Operations After Ransomware?
Restoring operations after ransomware requires confirming that the attacker no longer has access before any system returns to production. Restoring from backup into a still-compromised environment does not produce recovery. It produces a second infection from any persistence mechanism the attacker installed during their dwell period.
The restoration sequence that prevents re-infection:
Confirm eradication before restoration. Every persistence mechanism identified during the forensic investigation must be removed. Every attacker-created account must be deleted. Every compromised credential must be rotated. The environment must be confirmed clean by the forensic team before backup restoration begins, not assumed clean because the encrypted files are no longer visible.
Restore from the most recent clean backup. The clean backup is the most recent backup completed before the attacker gained access, not the most recent backup before encryption was noticed. Given the four to five day median dwell time, the backup from the day before encryption may itself contain attacker tools or pre-positioned payloads. Establish the initial access date forensically, then restore from a backup predating that date.
Restore in priority order. Critical business systems, authentication infrastructure, and communication systems come first. Secondary systems follow after primary operations are confirmed stable. Bring each system online carefully rather than in bulk, monitoring for any signs of re-infection as each segment is restored.
Test restored systems before reconnecting to the network. Validate each restored system against its expected configuration before network reconnection. This catches corrupted restores, configuration drift, and any malware that may have been present in the backup itself.
Organizations that never tested their backup restoration process before a ransomware attack consistently discover problems during the restore that they had no opportunity to anticipate. Organizations with tested, automated recovery playbooks contained ransomware incidents in a median of 51 days, compared with 79 days for those without automated processes.
What Security Work Must Happen Before You Return to Normal Operations?
Returning to normal operations without addressing the vulnerabilities that enabled the attack creates a high probability of a second incident. Attackers who target an organization once and achieve a payment frequently return, knowing the organization’s defenses and willingness to pay. The post-recovery security window is the highest-leverage moment to close the gaps that the attack exposed.
The security work that should happen before normal operations resume:
Identify and close the initial access vector. The forensic investigation should establish how the attacker initially gained access, whether through phishing, a vulnerable external service, a compromised third-party credential, or an unpatched vulnerability. That specific path must be closed before systems return to full network connectivity.
Conduct a vulnerability assessment of the recovered environment. Before declaring recovery complete, the recovered environment should be assessed for known vulnerabilities across all systems that were part of the incident. Our vulnerability assessment services provide a structured review of the recovered environment against known vulnerability categories to confirm the restoration did not introduce additional gaps.
Review and harden privileged access. Ransomware attacks almost universally rely on compromised or over-provisioned privileged accounts for lateral movement. The post-recovery review should include a complete audit of administrative accounts, service accounts, and identity configurations, removing any access that is broader than the function requires and implementing phishing-resistant MFA on all privileged paths.
Validate backup integrity and isolation. Given that 96% of attacks target backup repositories, the post-recovery period should include a formal review of backup architecture to ensure future backups are isolated, immutable, and regularly tested. An offline or air-gapped backup that attackers cannot reach during an incident is the single most effective recovery investment available.
For organizations using our security assessment services, this post-recovery review is structured to identify not just the residual vulnerabilities in the recovered environment but the control gaps that allowed the attack to progress as far as it did.
Get Your Free Security Assessment Quote
How Do You Prevent the Next Ransomware Attack?
The period immediately after a ransomware attack is when prevention investments receive the strongest organizational support, because the cost of the incident is still visible and the appetite for security spending is at its peak. That window should be used deliberately, focusing on the controls with the highest impact on reducing ransomware probability and blast radius.
The controls that address the most consistent ransomware entry points:
Enforce phishing-resistant MFA on all external access and privileged accounts. The majority of ransomware attacks begin with compromised credentials obtained through phishing or credential stuffing. Phishing-resistant MFA, specifically hardware security keys or passkeys rather than SMS or authenticator apps that can be bypassed through real-time phishing, closes the most common initial access path.
Patch externally exposed systems within days of critical CVE publication. Unpatched external services are the second most common ransomware entry point. A patching program that addresses critical CVEs on public-facing systems within 72 hours removes the exploitability window that most ransomware operators target.
Segment the network to limit lateral movement. Flat networks allow ransomware to propagate from an initial foothold to the entire environment. Microsegmentation and enforced network separation between business units, production systems, and backup infrastructure limits the blast radius of any single compromised machine.
Conduct regular penetration testing to find and fix exploitable paths before attackers do. Understanding the difference between a security audit and an adversarial test is important here. Our post on penetration testing vs security audits explains what each produces and when each is the right tool. Our penetration testing services specifically target the attack paths ransomware operators use, including credential access, lateral movement, and privilege escalation.
Implement continuous attack surface monitoring. Ransomware operators use automated reconnaissance to identify exposed services, unpatched systems, and misconfigured remote access tools across the internet. Our attack surface management service provides continuous visibility into your external exposure with the same view an attacker has, so new exposure is identified and addressed before it is exploited.
Frequently Asked Questions
Should you shut down systems immediately when ransomware is detected?
Not necessarily. Shutting down a system destroys active memory that may contain encryption keys, attacker credentials, or other forensic evidence critical to the investigation. The correct immediate action is network isolation, not shutdown. Disconnecting from the network stops the spread and cuts attacker access without destroying evidence. Consult with a forensic expert before shutting down any system that may contain valuable investigative data.
How long does it take to recover from a ransomware attack?
Recovery timelines vary significantly based on preparation. In 2025, 53% of organizations fully recovered within one week, up from 35% in 2024. Organizations with compromised backups face recovery costs eight times higher and timelines significantly longer than those with intact, tested backups. The median recovery time overall is around 24 days, but organizations with documented, tested recovery plans and automated playbooks consistently recover faster.
Is it safe to restore from backup after ransomware?
Only if the backup predates the initial attacker access, not just the encryption event. Given the median four to five day dwell time, the backup from the night before encryption may contain attacker tools or pre-positioned malware. The forensic investigation must establish the initial access date before selecting which backup to restore from. Additionally, the environment must be confirmed free of persistence mechanisms before restoration, or the restored systems will be immediately re-compromised.
Does ransomware always mean personal data was stolen?
Data exfiltration occurs in 96% of ransomware attacks in 2026, making every incident a presumptive data breach until the forensic investigation proves otherwise. Organizations should assume data was stolen and begin evaluating regulatory notification obligations from the moment of detection, rather than waiting for exfiltration to be confirmed. Notification deadlines run from the time of discovery, not from when exfiltration is confirmed.
What is the difference between ransomware recovery and disaster recovery?
Disaster recovery assumes a known, clean failure state, such as a hardware fault or natural disaster, where the environment is broken but not actively compromised. Ransomware recovery assumes an active adversary who may still have access to the environment, may have tampered with backups, and may be holding exfiltrated data as leverage. The critical difference is that restoring into a still-compromised environment produces a second infection. Ransomware recovery requires eradication confirmation before restoration begins, which disaster recovery does not.
Recovery Is the Beginning, Not the End
Recovering from a ransomware attack is not the end of the incident. It is the point at which the most important work begins: understanding exactly how the attack succeeded, closing the gaps it exploited, and building the controls that prevent a repeat. Organizations that treat recovery as the finish line and return to pre-attack security posture without substantive changes are among the most consistent targets for second incidents.
The security program that emerges from a ransomware incident should be measurably stronger than the one that existed before it. That means confirmed eradication, tested backup architecture, closed initial access vectors, validated privilege controls, and a penetration testing cadence that actively searches for the next exploitable path before an attacker finds it.
At Bugstrix, we support organizations through both the post-attack assessment phase, evaluating what the attack revealed about existing control gaps, and the ongoing security program that closes those gaps and maintains validated coverage going forward.
