If you are reading this during an incident, do three things before anything else. Disconnect the affected computers from the network. Do not turn them off or wipe them. Then contact your cyber insurer, followed by your counsel.
Then come back. The rest of this page is a plain guide to the first day, written for a business without its own security team. It is not legal advice, and anything your insurer or counsel tells you to do comes first.
Why it is worth planning for
Verizon’s 2025 Data Breach Investigations Report found ransomware “present in 44% of breaches” and pointed to its “disproportionate impact” on small and medium-sized businesses.
Recovery is getting faster. Sophos’s State of Ransomware 2025 found that 53% of organizations fully recovered within a week, up from 35% the year before. The steps below are about giving your own recovery the best start.
Hour 0 to 1: contain
The goal of the first hour is to stop the spread, not to fix anything.
- Disconnect, do not destroy. Unplug network cables and turn off Wi-Fi on affected machines. Leave them powered on if you can, because memory and logs help investigators. If you cannot disconnect a machine, shutting it down is better than leaving it connected.
- Take shared storage off the network. Disconnect file servers and NAS boxes, even if they look unaffected. Mapped drives are a common way for encryption to spread.
- Pause sync. Sync tools upload encrypted files to the cloud like any other change. Pause sync on machines that are still clean.
- Photograph the ransom note. Do not reply to it, and do not click anything in it.
- Move the conversation off the network. Assume office email may be watched. Coordinate by phone or through a separate messaging channel.
Hours 1 to 4: notify
- Your cyber insurer. Some policies require you to notify them before you hire responders or contact the attackers, and some name approved firms. Read your policy, or ask your broker.
- Your counsel. Counsel decides on any duty to notify clients, regulators or staff. Do not guess at these.
- Law enforcement. In the US you can report to the FBI through its Internet Crime Complaint Center (IC3), and to CISA. Your insurer or counsel may want to do this with you.
- Your IT provider and backup provider. Tell them what you see. Ask the backup provider one question first: are the backups intact?
Start a written log now, if nobody has: what happened, when, and who did what. Your insurer, counsel and any investigators will all ask for it, and memory fades fast on a day like this.
Do not pay or negotiate yet. If that decision comes at all, it belongs to the owner with counsel and the insurer, after everyone knows what the backups can do.
Hours 4 to 12: assess
- Protect the backups. CISA’s #StopRansomware Guide warns that “many ransomware variants attempt to find and subsequently delete or encrypt accessible backups.” Lock down any backup console the attacker might reach, and change backup admin passwords from a clean device. Off-site, immutable copies are the ones most likely to be untouched.
- Scope the damage. List which machines, servers, shares and cloud accounts are affected. Note when the first encrypted file appeared; file timestamps often show it.
- Find the last clean recovery point. For each system, pick the newest backup from before the first sign of trouble. Attackers sometimes get in days before they encrypt anything, so be conservative.
- Reset credentials. Admin accounts first, then email, then everyone else, all from clean devices. Turn on two-factor sign-in wherever it is missing.
Hours 12 to 24: restore
Restore onto clean systems, never onto the infected ones. Wipe and rebuild the hardware first, or restore to new machines or cloud virtual machines while the originals are examined.
Order matters. A sensible sequence for most small offices:
- Identity and network: directory services, firewalls and remote access, so people can sign in safely.
- The system that earns money today: the line-of-business app, the order system or the practice software.
- Email and files, if they were affected. Cloud mail is often untouched and can carry the business in the meantime.
- Laptops, one team at a time, each checked or reimaged before it reconnects.
Check each restored system before people use it. Is it clean? Are the newest records where you expect them? Should its scheduled jobs run yet, or would they send stale invoices or reminders?
The Standby Recovery plan, which runs alongside Server Backup, exists for this stage. A failed or quarantined server boots from its backup as a cloud virtual machine, with a target of 4 hours, and staff connect over a secure tunnel. It can run that way for up to 30 days per incident while the original hardware is examined and rebuilt, and a written plan for moving back is included.
Example: a food distributor’s Monday
Take a 55-person food distributor. Its warehouse system and file shares run on two servers, office staff use Microsoft 365, and its backups include a locked copy in a second region.
- Mon 6:10 a.m. The first warehouse clerk in finds files renamed and a ransom note on screen, and calls the operations manager.
- 6:40 a.m. Both servers and the NAS are unplugged from the network. Office laptops stay off Wi-Fi, and sync is paused.
- 7:30 a.m. The owner contacts the cyber insurer, who assigns a response firm, then counsel.
- 9:00 a.m. The backup provider confirms the locked off-site copies are intact. The local NAS backups were encrypted.
- 11:00 a.m. The response firm finds the first encrypted file at 2:15 a.m. on Sunday. Saturday night’s backups are chosen as the clean recovery point.
- 2:30 p.m. With admin passwords reset, the warehouse server boots as a cloud virtual machine from Saturday’s image. Staff connect through a secure tunnel.
- 6:00 p.m. Picking resumes for Tuesday’s deliveries. Orders taken on Sunday are re-entered from email.
The distributor lost a Sunday of data and most of a Monday. The servers themselves were rebuilt over the following week. It was a hard day, but a recoverable one, and every step in it had been written down months before, in a runbook kept off the network.
How we work on that day
When a client has an incident, a named engineer follows the written runbook, and the client gets an update every hour until systems are back. Clients on Standby Recovery and Server Backup can email support@ezbre.com with “URGENT” in the subject at any hour; those requests are answered within 2 hours, every day of the year.
We do not advise on whether to pay; that decision sits with you, your counsel and your insurer. Our job on the day is to tell you plainly what the backups can restore, from when, and how long it should take.
The fast data recovery service describes the restore drills, runbooks and standby servers behind that.
What not to do
A few instincts make the first day longer:
- Wiping machines straight away. It destroys the evidence investigators and insurers need, and it may not remove the attacker’s access.
- Restoring before resetting passwords. Restored systems go straight back into the attacker’s reach.
- Restoring the newest backup without checking it. It may hold the encrypted files, or the attacker’s tools.
- Talking about it on office email. Assume someone else is reading until the response firm says otherwise.
Before it happens
The best time to read this article is on a quiet day. Four things make the first 24 hours shorter:
- an immutable, off-site copy that nobody on your network can delete
- a written runbook with the restore order and the contacts you will need, printed
- a restore test in the last quarter, so you know the backups work
- your insurer’s incident contact and policy number, kept somewhere that does not depend on your network
Our ransomware recovery checklist sets out the first hour, first day and first week, plus what to put in place beforehand. Print it and keep it with your policy.
A quiet way to check
If you would like to know where your backups stand before you need them, the free backup check is a quiet way to find out. In 45 minutes, remotely, we look at your copies and who can delete them, run one test restore and send a written page of findings. Book a free backup check when it suits you.
