Ransomware: The First 24 Hours Decide Everything

It announces itself the same way in most businesses. Files stop opening, their icons go generic, and every folder has grown a new text file with a name like README or HOW_TO_RECOVER. Somewhere there is a note: your files are encrypted, payment is in cryptocurrency, here is how to reach us. Sometimes a countdown timer, for effect.

The next 24 hours matter more than anything you do in the following month — with one exception, which is whether a backup survives the morning. Work through this in order.

The first hour: isolate, don’t power off

1. Disconnect, do not power off. Pull network cables and turn off Wi-Fi on affected machines. Isolation stops the spread just as well as a shutdown, and it preserves two things a shutdown destroys: evidence held in memory that an investigator can use, and — on some variants — files that were mid-encryption and still recoverable. The machine is not your friend right now, but it is your witness.
2. Get to your backups before the attackers finish with them. Modern crews hunt backups deliberately, because a business that can restore does not pay — in a 2024 Sophos study, attackers went after the victim’s backups in 94% of incidents and succeeded more than half the time. A backup drive left permanently plugged in is usually encrypted along with everything else, so unplug whatever survives now. Then, from a clean device, change the passwords on cloud backup and storage accounts and sign out every session.
3. Take shared drives out of reach. One infected machine still connected keeps encrypting everything it can touch. Disconnect the file server from the network rather than powering it down, for the same reasons as above.
4. Photograph the ransom note and write down the time. The note’s wording, the extension on the scrambled files and the contact address identify the strain — which decides whether a free decryptor exists. Insurance and law enforcement will both want the timeline.
5. Do not wipe, reinstall or run a cleanup tool on anything yet. You may be destroying the evidence your insurer’s forensics firm needs, and occasionally the only copy of something recoverable.

Establish the scope before you decide anything

Walk the building, physically or by phone. Which machines show the note. Whether the server is hit. Whether the domain controller — the machine holding everyone’s logins — is hit, because that turns the rebuild from “some machines” into “everything”. From a clean device, check Microsoft 365 or Google Workspace for sign-ins you don’t recognise and mail rules you didn’t create.

Assume your data was copied out, not just encrypted. Crews routinely steal files before encrypting and threaten to publish them — it is their answer to good backups. Stolen customer or employee data can trigger notification duties under state law, which is a conversation for a lawyer, not a judgment call to make alone.

Pay or don’t pay, without the sermon

Paying is a business decision, not a technical one, and it is never the first move — you cannot make it sensibly until you know what you can restore. The numbers are worth having. In Sophos’s 2026 survey of ransomware victims, 48% of organisations whose data was encrypted paid, while two-thirds restored from backups (some did both). Of those who paid, half settled below the original demand — the figure in the note is an opening bid, not an invoice.

What payment buys is a decryptor: often slow, sometimes buggy, useless on files the malware corrupted. It buys no proof that stolen data was deleted — you are taking a criminal’s word for that — and it does nothing about the hole they came in through. There is also a legal edge. The US Treasury’s sanctions office has warned since 2020 that paying a sanctioned group can bring civil penalties even if you had no idea who you were paying. Which is why payments, if they happen at all, go through your insurer and a professional negotiator — never through a direct email from you.

Call your insurer before you spend a dollar

If you carry cyber insurance, the policy almost certainly has a notification clause with teeth: notify promptly, use the carrier’s approved forensics and negotiation firms, and get written consent before any payment. Pay first and ask later, and the payment — sometimes the whole claim — may not be covered. The upside is real too: a good carrier puts breach counsel, forensics and negotiators on your incident within hours, at rates they have already agreed. Make this call the same morning.

Report it — one report reaches three agencies

Report the attack to the FBI at ic3.gov, to CISA at report@cisa.gov or 1-844-729-2472, or to your local Secret Service office — as of 2026, one report to any of them notifies the others, so you file once. It costs nothing and occasionally pays: for some strains, law enforcement holds seized keys and free decryptors. The report also creates the official record your insurer, and any regulator involved later, will expect to see.

The recovery sequence for a small business

1. Find the way in. Most attacks start with a login, not a genius — Sophos’s 2026 report traced 79% to compromised identities: a phished password, remote access left open to the internet, an account with no second factor. Restore without closing the hole and you will be encrypted again within weeks; repeat visits are common enough that crews keep notes.
2. Rebuild, don’t clean. Once forensics has what it needs, wipe infected machines and reinstall from known-good media. “Cleaned” machines have a way of still carrying the attacker’s tools.
3. Reset every password and turn on two-factor authentication — every account, not just the obviously affected ones. Assume every credential those machines ever saw is in the attacker’s hands.
4. Restore data from the surviving backup, most critical systems first, and open the restored files before declaring victory.
5. Watch for a few weeks — odd outbound traffic, new accounts, sign-ins at strange hours. If nobody in the building can do this, a tech on Koadi can set up the monitoring remotely.

Prevention is the actual moral

Everything above is worse than the short list that would have prevented it:

• A backup the attacker cannot reach — offline or immutable — tested by actually restoring something. The 3-2-1 rule is the standard for a reason, and setting it up properly is an afternoon’s work.
• Two-factor authentication on email and every remote-access path. With four out of five attacks starting from a stolen identity, this is the single control that earns its keep.
• Updates applied promptly to anything reachable from the internet — firewalls, VPNs, remote desktop.
• Staff who can spot a phishing email and know that odd requests get a phone call.
• Once the basics are in, work through a full cybersecurity checklist — and consider a penetration test, which is paying someone friendly to find your holes before someone less friendly does.

If this lands on you today

Ransomware response is not a first-timer’s job, and you do not have to run it alone. Post what happened free, in plain words — vetted, identity-verified technicians who handle incident response pick it up, you set a fixed price or take bids, and payment sits in escrow until you approve the work. Remote help is available in minutes anywhere in the US, evenings and weekends included, with on-site visits through local technicians when hands are needed. Afterwards, Koadi runs vulnerability assessment and penetration testing with an actionable report — so the next attempt finds the doors locked.