Ransomware attack: what to do in the first 24 hours

The first hour: stop the spread, keep the evidence

In the first 24 hours after a ransomware attack, five things matter: isolate affected systems, alert the right people, preserve evidence, check reporting duties and prepare a recovery from clean backups. Ransomware encrypts data and locks systems, often combined with a threat to publish stolen data. As soon as you notice encrypted files, unfamiliar file extensions or a ransom note, the first goal is to stop the spread without destroying evidence.

• Unplug network cables and switch off Wi-Fi on affected devices.
• Isolate suspicious servers and network segments at the switch or firewall, and temporarily block VPN access.
• Disconnect backup systems from the network so that they are not encrypted as well.
• Photograph the ransom note and write down the time and your first observations.

Alert the right people and form a crisis team

Inform management, internal IT or your IT service provider, and the person responsible for data protection straight away. A small crisis team makes decisions, assigns tasks and records who did what and when. You will need this log later for notifications, insurance and analysis.

Coordinate through a channel that is unlikely to be affected by the attack, such as phone calls or mobile devices under clear rules. In some cases attackers have access to mailboxes or chat systems and could be reading along. Give staff a short, clear instruction: do not restart devices, do not delete anything, report anything unusual.

Decide early who speaks to customers, partners and, if necessary, the media. Keep statements factual and agree them with your legal adviser, especially before any data theft has been confirmed.

Preserve evidence and bring in specialists

Logs from firewalls, servers, endpoint protection and cloud services are often kept only for a limited time. Export them early and store them separately from the affected network. Affected disks should not be overwritten until it is clear whether a forensic copy is needed.

Bring in specialised incident response experts early. They help assess the scope, find the entry point and establish whether data has been stolen. If you have cyber insurance, inform the insurer straight away as well: many policies require prompt notification and name their own emergency contacts.

Notifications: data protection authority, NIS2 and police

A ransomware attack is almost always a legal matter too. Some notifications are required by law, others are strongly advisable, and what applies depends on the individual case. Check these points within the first 24 hours, ideally together with your legal adviser:

• GDPR: if personal data is affected, the breach has to be reported to the Austrian Data Protection Authority under Art. 33 GDPR without undue delay and, where feasible, within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to the people affected. If a high risk is likely, those people must also be informed.
• NIS2: if your company is covered by the NISG 2026, significant incidents must be reported to the competent CSIRT: an early warning within 24 hours and a notification within 72 hours. Read more in our article on NIS2 for SMEs.
• Police: extortion and damage to data are criminal offences. Filing a report at any police station is advisable, and your insurer may also require one.
• Customers and contracts: if you process personal data on behalf of customers, you must inform them without undue delay as their processor. Contracts with customers or partners may also contain notification duties.

Paying the ransom: not a decision to make under pressure

The pressure is high when operations have stopped. However, paying does not guarantee that the key works, that all data comes back or that stolen data will not be published anyway. It also funds the attackers and can mark you as a target that pays.

Authorities generally advise against paying ransoms. Payments can also raise legal questions, for example if the recipients are subject to sanctions. Check alternatives first: for some ransomware variants, the No More Ransom project, in which Europol is involved, offers free decryption tools.

Restore from clean backups

The most reliable way back is to restore from backups that the attacker could not reach. This is exactly what the 3-2-1 principle with an immutable copy is for. Before restoring, you need to know when the attack began, because attackers have often been inside the network for some time.

1. Identify and close the entry point, for example an unpatched remote access service or a compromised account.
2. Determine clean restore points and scan backups for malware before restoring them.
3. Rebuild systems from trusted installation media where possible instead of just cleaning them.
4. Reset all passwords, especially for administrator and service accounts, and enable MFA.
5. Restore critical systems first and monitor operations closely afterwards.

Timeline at a glance and follow-up

Once systems are restored, the follow-up begins. Record how the attackers got in, what worked well and where there were delays. This produces concrete measures for technology, processes and training.

Preparation: what you can do today

Most decisions in the first 24 hours can be prepared in advance. In an emergency, a short incident plan of a few pages is worth more than a lengthy document that nobody has read.

1. Write a short incident plan with roles, decision paths and first steps.
2. Keep a contact list for IT, service providers, insurer, legal advice and authorities, also on paper.
3. Keep at least one offline or immutable backup copy and test restores regularly.
4. Introduce MFA for email, remote access and administrator accounts, and install updates promptly.
5. Rehearse an incident in a short exercise once a year.

Q-entra helps you build the incident plan, backup strategy and protective measures as part of cyber security, and keeps an eye on systems, updates and backups on an ongoing basis with managed security.