Ransomware Incident Response Plan: The First 24 Hours

The businesses that come out of a ransomware attack in the best shape are almost never the ones with the best technology. They're the ones who knew, before anything happened, exactly what to do in the first hours. Improvising under pressure — with systems down, an executive WhatsApp chat asking what's happening, and a clock running against you — is the surest way to make mistakes that become irreversible. This guide describes, realistically and hour by hour, what the response should look like.

The natural instinct when something looks wrong is to shut everything down. That's almost always the wrong instinct. Abruptly powering off systems can destroy volatile forensic evidence — information in RAM that disappears the moment a machine is powered down — and in some cases can trigger additional encryption routines the malware has programmed as a response to an abrupt shutdown attempt.

The right move in this first hour is to isolate, not power off: disconnect affected systems from the network (unplugging the network cable or disabling Wi-Fi, not shutting the machine down), to stop lateral spread without losing evidence. If there's doubt about which systems are compromised, it's better to err on the side of isolating more than strictly necessary.

This is the moment to formally activate the response plan — not to start designing it. If your business doesn't have one defined in advance, having an external 24/7 incident response team that can step in immediately is what replaces that missing preparation.

In parallel, someone needs to start documenting with exact timestamps: when the first sign was detected, which systems were identified as affected, what actions were taken and in what order. This documentation isn't a bureaucratic exercise — it's the foundation for any subsequent forensic analysis, any insurance claim, and any legal process under Law 1273.

Before making any major decision — including whether to consider paying a ransom — you need to understand what actually happened. Which systems are encrypted? Is there evidence of data exfiltration, pointing to a double extortion scenario? Are backups still intact and isolated, or were they compromised too? This technical assessment, more than any other factor, determines what real options are actually available.

While the technical team works on containment and diagnosis, someone in the organization needs to decide what gets communicated, to whom, and when. This includes internal communication (employees who need to know what's happening without unnecessary panic), communication with clients or partners if there's service impact, and assessing the legal reporting obligations we cover in detail in our guide on when reporting a cyberattack is legally required in Colombia.

A common mistake at this stage is total silence, which tends to generate more long-term distrust than honest, even if incomplete, communication about what's known so far.

With the scope now assessed, it's time to define the recovery path: restoring from backups if they're available and clean, looking for a decryption tool if one exists for the specific variant, or evaluating the payment option if none of the above is viable — a decision we cover in detail in our guide on whether you should pay a ransomware ransom. It's also the moment to review the specific technical recovery options covered in our guide on how to recover files without paying.

A response plan written for the first time during the incident is already too late. The minimum that should exist in advance: