Ransomware attack: what to do in the first hours

How to recognise it

Ransomware rarely makes a dramatic entrance. The first signs are mundane: a file that will not open, unfamiliar file extensions, shared folders full of renamed files, a text document with payment instructions. Sometimes there are signs even earlier: antivirus disabled, recently created administrator accounts, unusual outbound network traffic.

Many modern attacks use double extortion: before encrypting, the attackers copy the data out and threaten to publish it. So the problem is not only the availability of the data, but also its confidentiality.

The first hour: contain

1. Isolate, do not switch off. Disconnect the affected systems from the network, both cable and Wi-Fi, and disable remote access such as VPN and remote desktop. Do not switch them off: shutting down loses information that exists only in memory and is needed for the analysis, and risks stopping an encryption halfway through.
2. Activate the plan and call in the right people. Who decides, who acts, who communicates. If there is an incident response plan, now is the time to put it into action; if there is not, you need one person to coordinate everything, straight away.
3. Communicate out of band. If company email or accounts may be compromised, coordinate by phone or through external channels: the attacker could be reading internal messages.
4. Protect the backups. Check that the copies are intact and disconnect any that can be reached from the network. Do not start restoring until it is clear how the attacker got in: you risk restoring systems that will be encrypted again.
5. Preserve the evidence. Photograph the ransom demands and on-screen messages, keep the logs, and note down every action with the time. They are needed for the analysis, the notifications and any police report.

The following hours: understand and decide

Once the attack is contained, the work turns to analysis: finding the entry point (a compromised mailbox, reused credentials, an exposed and unpatched service), working out how long the attacker has been inside, which systems and data are involved, and whether any data has been stolen.

The next decisions depend on these answers: what to restore and in what order, which credentials to change, what to tell customers and suppliers.

Notification duties

Ransomware is almost always a personal data breach as well: the data becomes unavailable and, with double extortion, may have been stolen. The deadlines run from the moment the company becomes aware of the incident, so they need to be considered from the first hours.

• GDPR: the controller notifies the Italian Data Protection Authority (Garante) of the breach within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to people. If the risk is high, the data subjects must also be informed.
• NIS2: entities within the scope of Legislative Decree 138/2024 send CSIRT Italia (Italy's national computer security incident response team) an early warning within 24 hours of becoming aware of a significant incident, an incident notification within 72 hours and a final report within one month.
• Police report: it is advisable to file a report with the Polizia Postale (the Italian State Police unit responsible for cybercrime).
• Insurance: if the company has a cyber insurance policy, notify the insurer immediately: many policies set out specific procedures and deadlines.

This is a general summary: for your specific case, you should get support from your legal adviser or data protection officer (DPO).

Should you pay the ransom?

It is a decision that should not be taken on impulse, or alone. Paying does not guarantee you will get the data back, or that stolen data will not be published or resold, and it funds further attacks. Law enforcement and cyber security agencies generally advise against paying.

The real alternative to the ransom is built in advance: isolated, tested backups that let you recover without negotiating. We cover this in the guide on the 3-2-1 backup rule.

Recovering safely

1. Close the entry point: fix the vulnerability that was exploited and block the access routes used by the attacker.
2. Change the credentials: first administrator and service accounts, then user accounts.
3. Restore by priority: core services such as network and authentication first, then critical systems, according to the agreed recovery times (see the guide on RTO and RPO).
4. Check before reopening: make sure the restored systems are clean and monitor them closely in the following weeks.
5. Analyse and improve: what worked, what did not, what needs to change in the plan.

Prepare in advance: the checklist

Everything that makes the first hours manageable is decided in the quiet months. A quick check:

• there is an incident response plan, with roles and phone numbers, also available on paper;
• backups have at least one isolated or immutable copy, and restore tests are documented;
• remote and administrative access is protected with multi-factor authentication;
• internet-facing systems are kept up to date and monitored;
• people can recognise a suspicious email and know who to report it to;
• you know whether your company falls within the scope of NIS2 and who is responsible for notifications.

The story The Friday evening the files changed their names shows how a real attack unfolds when this list has already been ticked off.