The first hour sets the trajectory for your entire recovery. Every minute counts, but rushing leads to mistakes.
Hour 1 Checklist:
What NOT to Do in Hour 1:
- Don't pay immediately: 68% of companies that pay in the first hour pay more than necessary
- Don't contact the attacker yet: Let professionals handle initial communication
- Don't start restoring from backups: You might restore infected backups
- Don't post on social media: This alerts competitors and can panic customers
This is where most companies make their first major mistake: focusing on recovery before understanding the attack.
Critical Investigation Steps:
- Scope the attack: Which systems are affected? What data was accessed?
- Identify the variant: Different ransomware has different decryption options
- Find patient zero: How did they get in? (Phishing, RDP, vulnerability)
- Check for data exfiltration: 89% of modern ransomware steals data before encrypting
- Preserve forensic evidence: Memory, logs, disk images for legal proceedings
Containment Strategies:
| Strategy | When to Use | Pros | Cons |
|---|---|---|---|
| Network Segmentation | Large networks, spread detected early | Minimal business disruption | Complex to implement correctly |
| Complete Isolation | Critical systems affected, rapid spread | Stops attack immediately | Total business disruption |
| Targeted Shutdown | Limited infection, identified patient zero | Preserves evidence, minimal disruption | Risk of missing compromised systems |
By hour 24, you should have enough information to make informed decisions.
Decision Framework:
Questions to Answer Before Deciding:
When Payment Might Be Necessary:
- No backups or backups are also encrypted
- No decrypter available for this variant
- Data was stolen and will be published
- Business impact exceeds ransom demand
- Critical systems affected (healthcare, utilities)
When to Avoid Payment:
- Clean backups available and tested
- Free decrypter exists
- Data wasn't stolen (confirmed)
- Attackers have poor reputation for decryption
- Legal/regulatory restrictions apply (sanctions)
By now, decisions are made. It's time to execute recovery while managing communications.
Recovery Execution Checklist:
Communication Timeline:
- Hour 1-24: Internal team only (need-to-know basis)
- Hour 24-48: Executive team and board
- Hour 48-72: Employees (transparent but controlled)
- Hour 72+: Customers/partners (if data breach confirmed)
- As required: Regulators (GDPR: 72 hours from discovery)
Recovery Validation:
Before declaring recovery complete:
- Test all critical business functions
- Verify no ransomware remains in environment
- Confirm monitoring is detecting anomalies
- Document everything for insurance and legal
7 Common Mistakes That Cost Companies Millions
Mistake #1: Paying Too Early
Impact: Average overpayment of 217%
Solution: Always negotiate. Initial demands are opening positions.
Mistake #2: Destroying Evidence
Impact: Invalidates insurance claims, prevents legal action
Solution: Preserve everything. Don't turn systems off.
Mistake #3: Restoring Infected Backups
Impact: Reinfection, extended downtime
Solution: Test backups in isolated environment first.
Mistake #4: Poor Communication
Impact: Panic, misinformation, regulatory penalties
Solution: Designate single spokesperson, use encrypted channels.
Mistake #5: Ignoring Data Theft
Impact: Future extortion, regulatory fines for non-notification
Solution: Assume data was stolen until proven otherwise.
Mistake #6: Going It Alone
Impact: Longer recovery, higher costs, more mistakes
Solution: Engage experts early. Experience matters.
Mistake #7: Not Learning Lessons
Impact: Repeat attacks, continued vulnerability
Solution: Conduct post-incident review, update security controls.
When to Get Professional Help
Based on our experience with 100+ incidents, you should engage professional incident response when:
Our 24/7 incident response services provide senior DFIR practitioners from the first call, not junior analysts. We've handled cases from £10,000 to £4.3 million ransom demands.
Download the Complete Incident Response Playbook
This article covers the first 72 hours. For complete guidance including checklists, templates, and decision frameworks, download our free playbook: