Recovering from a ransomware attack: the first 72 hours

Hour one: contain without destroying evidence

Unplug network cables and turn off Wi-Fi on any computer showing ransom notes or renamed files. If the spread is wide or unclear, disconnect the office from the internet at the router. Resist the urge to power everything off or wipe it: memory and logs on a running machine can show how the attacker got in and what they took. Do not log in to other systems with administrator accounts from an infected machine, and do not reply to the attackers. Take photos of ransom notes and note the time you first noticed problems. Those details help investigators and your insurer.

Make the calls in the right order

If you have cyber insurance, call the insurer's incident line early. Many policies require you to use their appointed response firm, and costs you run up beforehand may not be covered. Then bring in your IT provider, and tell them the insurer's requirements so work is not duplicated. Report the incident to the National Cyber Security Centre. They can sometimes share information about the specific ransomware group and known decryption options. If personal information may have been accessed, start your Privacy Act assessment now, because notification is required as soon as practicable once you believe serious harm is likely.

Day one: find the scope and the way in

Before restoring, work out which systems are affected, how the attacker got in and which accounts they used. Common findings are a compromised remote access account, a phishing email that installed a loader, or an unpatched VPN device. Until that door is closed, anything you restore is at risk again. Reset passwords for every privileged account and any account the attacker touched, from a clean device. Revoke active sessions in Microsoft 365. Check for new user accounts, forwarding rules, scheduled tasks and remote access software you did not install; attackers often leave several ways back in.

Days two and three: restore cleanly

Rebuild servers and computers from known-good media rather than trying to clean them. Then restore data from a backup taken before the intrusion began, which may be earlier than the day encryption happened. Scan restored data before putting it back into use, and bring systems back one at a time while watching for any sign of renewed activity. Prioritise by business need. Email and the line-of-business system that earns revenue usually come first; archived projects can wait. Tell staff what is back, what is not and how to work in the meantime, so nobody quietly reconnects an old infected laptop to get a file.

Talking to customers and staff

Silence breeds rumours. Give staff a short, honest update and a single person to ask. For customers, say what has happened in plain terms, what you are doing and whether their information is involved, once you know. Agree any external wording with your insurer or legal adviser, but do not let that delay notifying people whose information is at risk. Keep messages factual and avoid guessing. Saying you are still investigating is better than an early assurance that no data was taken, followed by a correction a week later that does more damage than the original news.

After the dust settles

Hold a review within a few weeks while memories are fresh. List what worked, what slowed you down and what you would change. Typical outcomes are immutable backups, EDR, removing everyday admin rights and an offline contact sheet. Write the lessons into your incident plan so the next response, if there is one, starts from a better place.

Keep a log from the start

Appoint one person to write down everything that happens, with times: when the problem was noticed, who was called, which machines were disconnected, which passwords were reset and which decisions were made and by whom. In the heat of an incident it feels like paperwork, but it becomes essential within days. Your insurer will ask for a timeline, the Privacy Commissioner may want to know when you became aware of a breach, and your responder will need to know exactly what was changed before they arrived.

Keep the log somewhere the attacker cannot reach, such as a paper notebook or a personal device that was never connected to the affected network. Use the same place for contact numbers, the insurer's claim reference and notes from each call. Once the incident is over, this record becomes the backbone of your review and a ready-made template for the next plan.