what to do in the first 48 hours
of a ransomware attack.

hour 0-1what NOT to do

The instinct is to act fast. Correct — but most obvious fast actions make it worse. The next 60 minutes are the highest-leverage window, and the most common mistakes happen here.

What to do in the first 15 minutes:

• Identify one confirmed-compromised machine. Note the hostname or IP and the time you discovered it.
• Do NOT touch other machines yet. Observe. Look for symptoms spreading (ransom notes on desktop, encrypted file extensions, systems hanging).
• Call your IT provider from a non-compromised device. If you don’t have one, use a personal cell with a personal hotspot, not the office WiFi.
• If you have cyber liability insurance, pull up your policy number. You’ll need your insurance carrier’s incident response line within the first hour.

hour 1-4isolate, communicate, document

You've made contact with your IT provider. This phase is containment — stop the spread, preserve evidence, establish clean comms.

Isolation priority:

• Network segment isolation first: if your switches have VLAN capability, use it to cut infected segments from the broader network at the switch level, not the device level. This is faster and more thorough than unplugging individual machines.
• After network isolation: disconnect affected machines from power (not a graceful shutdown — pull the plug or hold the power button). This preserves memory state which may contain encryption keys or indicators of the attack chain.
• Explicitly do NOT reboot compromised machines. Rebooting destroys volatile memory. Memory forensics can extract encryption keys from RAM that have not yet been flushed. PCA was able to use this in the Qilin response.
• Identify and physically isolate backup storage. If your backup device is network-connected and not air-gapped, disconnect it now. Ransomware specifically targets backup systems to maximize leverage.

Communication setup: Personal cell phones, personal email, personal mobile hotspot. Assume corporate email, Slack, and file shares are compromised until confirmed otherwise.

Documentation starts now: Timestamp every action: who, what, when, which system. Required by insurance, required by law enforcement, essential for forensics. A Google Doc on personal Gmail via personal hotspot is fine.

hour 4-24triage what’s encrypted, what’s exfil’d, what’s still safe

Containment is established. Clean communications are running. Now the hard work begins: understanding the actual scope of the damage.

Encryption triage: Identify which file types were targeted. Most ransomware variants have a specific list of extensions they encrypt (Office docs, PDFs, databases, images). Identify which shares and servers are affected and which are not. Build a list of impacted vs. clean systems — this is your recovery priority order.

In the Qilin incident, we found that the ransomware had specifically targeted the file server and shared drives but had not reached the SQL database server — because the database server was on a separate network segment that had been configured months earlier for performance reasons. That segment isolation, not security-intentional, saved the most critical data.

Exfiltration assessment: This is harder than encryption assessment and is often overlooked. Ransomware-as-a-service operators frequently exfiltrate data before encrypting it, using the stolen data as additional leverage (“pay or we publish your customer records”). Look at firewall logs for unusual outbound traffic volumes in the 24-48 hours before the attack became visible. Large transfers to unknown external IPs in that window are a signal of exfiltration.

Identify what’s still safe: Confirm which systems never connected to the compromised segment. Confirm backup integrity (checksums if available, visual inspection of file listings if not). Confirm whether cloud services (Microsoft 365 SharePoint, OneDrive) are affected. In the Qilin incident, SharePoint was unaffected because it was cloud-hosted and the attacker had not escalated to M365 admin privileges.

Preserve evidence: Before any restoration or wiping begins, image affected drives. This is a forensic copy of the encrypted state. Your cyber insurance provider and potentially law enforcement will need this. Drive imaging before remediation is standard practice — skip it and you lose your claim documentation.

hour 24-48legal + insurance + customer notification (Texas law)

By this point your immediate technical crisis is contained. The next 24 hours are dominated by legal, insurance, and notification obligations — which have their own time windows that start running from the moment of discovery, not the moment of containment.

Cyber liability insurance: If you have a cyber liability policy, you should have already made first contact in hour one. If you haven’t, do it now. Most cyber policies have coverage that kicks in only if you’ve followed their incident response protocol — which often includes using their approved forensics vendor, not your MSP’s preferred one. Read the policy before you start remediating. Remediation that happens without insurer approval may void your claim.

Law enforcement: In the US, ransomware is a federal crime. Report it to the FBI’s IC3 (Internet Crime Complaint Center) at ic3.gov. This is not optional. The report helps investigators track variants and, in some cases, has led to decryptors being released when law enforcement has seized attacker infrastructure. The Qilin variant had known decryptors available through a coordinated law enforcement action — a report to IC3 connects you to that intelligence network.

Texas notification law: If you’ve determined that personal information was exfiltrated — customer names, email addresses, Social Security numbers, financial account data — Texas law requires notification. Tex. Bus. & Com. Code § 521.053 requires that affected individuals be notified “as quickly as possible” after discovery of a breach, and that the Texas Attorney General be notified if the breach affects 250 or more Texas residents. The clock starts from the date of discovery, not the date of forensic confirmation. Get legal counsel on the phone in this window — not after you’ve sent a notification that doesn’t meet the statute’s requirements.

Customer and vendor communication: If your business has customers, vendors, or partners who may be affected by this incident — either because their data was at risk, or because your system outage affects their operations — communicate early and clearly. A brief, factual statement (“we are responding to a cybersecurity incident, we’ll update you by [date]”) is better than silence. Silence damages trust more than the incident itself in many cases.

the recovery decision tree

By the end of hour 48, you’re moving into recovery. The path depends on what you have available and what was affected.

six things to do BEFORE you ever get hit

Each item costs less than one hour of ransomware downtime. Most small businesses have none. Implement four out of six and you're in the top 20% for resilience.

• Immutable backup, physically or logically isolated. A backup that lives on a network share on your office server is not a backup — it’s a second copy that will be encrypted along with the first. You need a backup that cannot be modified or deleted from the network: a cloud backup with object lock (AWS S3 with Glacier Vault Lock, Azure Blob with immutable storage), a tape or external drive that is physically disconnected after backup, or a managed backup service with air-gap capability. This is the single highest-ROI security investment for a small business.
• MFA on everything with an internet-facing login. Microsoft 365, RDP, VPN, any cloud service your business uses. Qilin’s most common entry vector is compromised credentials. MFA means compromised credentials alone are not enough to gain access. This is free on Microsoft 365 and takes an afternoon to enable. There is no excuse for MFA not being on.
• Patch everything, including network appliances. Your firewall, your VPN concentrator, your NAS — these are not “set and forget” devices. They have firmware updates that fix critical vulnerabilities. An unpatched SonicWall firewall was the entry point for a significant ransomware campaign in 2021. Check manufacturer advisories monthly. This is part of what a managed IT provider should be doing for you automatically.
• Segmented network. Put your file servers on a different VLAN from your workstations. Put your backup storage on a third segment. Lateral movement is how ransomware spreads from one compromised machine to your entire environment. Network segmentation slows that spread and may limit the blast radius to a single segment. This is a configuration change, not a purchase.
• Endpoint detection and response (EDR), not just antivirus. Traditional antivirus is signature-based — it looks for known malware. EDR is behavior-based — it looks for malicious activity patterns regardless of whether the specific malware is known. Qilin variants are regularly updated specifically to evade AV signatures. SentinelOne, CrowdStrike, and Microsoft Defender for Business all have EDR capability. Consumer AV does not.
• Documented incident response plan. You are reading this guide mid-incident or pre-incident. If pre-incident: print this page and put it somewhere physical that survives the loss of your digital environment. A laminated sheet in the server room. An email to a personal account with the link to this page. The worst time to look up “what do I do in the first hour of ransomware” is during the first hour of ransomware.