CYBCybersecurity

Ransomware attack in progress: what to do in the first four hours

Encrypted files and a ransom demand. The technical moves for the first four hours, from isolating systems to protecting the backups, from evidence to sizing up the damage, through to the most delicate choice of all, the ransom.

Strategic editorial team 30 August 2026 9 min read

Cover: “Ransomware attack: the first four hours”, Cybersecurity

In the first four hours of a ransomware attack, meaning a program that encrypts your data and demands a ransom to give it back, four moves matter, in this order. Stop the spread by isolating the affected systems without erasing the traces. Protect the backups. Find out what has been encrypted and what has been taken. Gather what you need to decide. The decision on the ransom comes later, with legal counsel, and is never taken in the dark. Four hours is not a legal deadline. It is the time in which a serious incident can still be contained.

Why do the first hours weigh so heavily?

For three reasons. The attacker is often still in the network and can hit other systems, including the backups. The traces that show how they got in sit in the memory of the systems that are still running, and they are quickly lost. And for companies covered by NIS2, the EU directive on network and information security, the deadline for the early warning to the authorities runs from the moment you become aware of the incident.

A typical scenario. At three in the morning, a warehouse worker sees the files on the shared server change name one after another. Then a screen appears with a countdown and instructions for paying. The instinct is to pull the plug on everything. That is understandable, but almost always wrong.

Many groups copy the data before encrypting it and threaten to publish it. This is known as double extortion. So restoring from backups is not enough. You still need to work out what has left the company.

Switch off or isolate?

Isolate. Isolating means disconnecting the affected systems from the network, by unplugging the cable, turning off Wi-Fi or blocking them on the network equipment, while leaving them switched on. If many systems are involved, the #StopRansomware Guide from the US cybersecurity agency (CISA) advises disconnecting the network at switch level, the devices that route traffic within it. The same guide reserves switching off for devices that cannot be disconnected, to stop the infection spreading.

A running system holds active processes, connections and sometimes the keys used in the attack in its memory. That is why CISA recommends capturing a disk and memory image of some of the affected devices. It is also why you do not reinstall, delete or reboot “to see if it comes back”. The guide also suggests coordinating the isolation by phone, so as not to alert the attacker that they have been discovered.

What should you do in the first hour?

Isolate the affected systems in a coordinated way, along with those that communicate with them, and record every action.
Protect the backups. Disconnect the backup systems that can be reached from the network, suspend access to them and check whether there are WORM copies, meaning copies that can be written only once and are locked for a set period. For backups to hold up you need the rules described in Grandad’s backup.
Close the entry points attackers use most. That means suspicious administrator accounts, suppliers’ remote access and links between sites. New passwords are chosen on a workstation that has never been connected to the affected network.
Open the incident log. Record the time of discovery, who saw what and every action with the name of whoever took it.
Alert the decision-makers on channels that do not go through the affected systems. Company email and chat may be read by whoever got in.

Who does what in the second hour?

The crisis committee is the small group that takes decisions during the incident. It works if the roles were written down beforehand. Its mandate, communication and notifications are explained in the article on management decisions in the first hours. On the technical side, the tasks are divided as follows.

Role	What they do during a ransomware attack
Head of IT and security	Containment, status of systems and backups, order in which systems are restarted
Incident response specialists, in-house or external	Forensic analysis, ransomware family, point of entry
Legal counsel	Checks on international sanctions before any contact with the attackers
Insurer, if there is a cyber risk policy	Must be notified within the terms of the policy. Some policies require the providers you bring in to be agreed with the insurer

Employees need a short message straight away. It should tell them what not to touch, which channels to use and whom to report anything unusual to, without offering explanations that have yet to be checked.

In parallel, forensic collection begins. It covers copies of the disks and memory of the most representative systems, along with network, login, email and security device logs. Every piece of evidence must come with a chain of custody, the written record of who collected it, when, and how it was stored. Without one, its value before a judge or a court-appointed expert is weakened. For logs to be useful they must have been kept beforehand, as explained in Sherlock Holmes and the log files.

How big is the damage, between the second and fourth hours?

The work runs on two tracks.

The technical track establishes which ransomware family is involved, where the attack got in, which accounts it used, which is the last intact backup and how long the restore will take. The No More Ransom portal, set up by Europol and the Dutch police, collects the decryption tools already available. You search it by entering the ransomware family.
The data track establishes what has left the company. The logs are searched for unusual transfers in the preceding weeks, and the sites where criminal groups claim their attacks are checked. The company’s name and samples of its data often appear there. These are the same external signals that, when watched beforehand, help uncover intrusions in time.

By the end of the fourth hour the picture is incomplete but useful. You know which systems are affected, which backups are available, how long restarting will take and what the clues are about stolen data. This is what senior management needs for the notifications. They go to CSIRT Italia, Italy’s national computer security incident response team, for entities covered by NIS2, and to the Italian Data Protection Authority (Garante) if personal data is involved. A criminal complaint also goes to the Polizia Postale, the Italian State Police’s cybercrime unit. Deadlines and recipients are summarised in the table in the article for management.

How do you restart without being hit again?

You restore into a cleaned environment, not on top of infected systems. The order is decided by people who know the business. First come the services without which the company comes to a halt, then everything else. Before putting a system back on the network, change the credentials the attacker may have seen. Then check that the backups you use date from before the intrusion, not just from before the encryption. CISA suggests keeping ready-configured reference images of the main systems, so that you can restart quickly.

Should you pay the ransom?

It is a decision for senior management, not a technical one, and it rests on a few fixed points.

Paying does not guarantee anything. The key may not arrive or may only partly work, and the stolen data stays in criminal hands. The No More Ransom portal advises against paying.
International sanctions matter. On 24 June 2024 the Council of the European Union added people linked to the Conti and Trickbot programs to its sanctions regime against cyber-attacks. EU persons and organisations are prohibited from making funds available to those listed, so paying a sanctioned group can breach this ban. Checking is a job for the lawyers.
No improvised contact. Before any exchange with the attackers, the committee decides who speaks, with what mandate and with which advisers.
The decision is put in writing, with the alternatives considered, and the insurer and the authorities are informed.

What should you prepare before it happens?

A short plan, printed and kept outside the systems, with roles, deputies, phone numbers and the order in which systems are restarted.
Isolated backups and a restore that has really been tested, with the times measured.
An up-to-date list of critical systems and administrator accounts, as the starting point for isolation.
Agreements already signed with incident response specialists and lawyers.
Security tools that are configured and looked after over time, including those bought with a grant, because a grant pays the invoice, not for real security.

In brief

In the first hour you isolate rather than switch off, unless a system cannot be disconnected.
Backups must be protected immediately, before the attacker reaches them.
Decision-makers meet on channels outside the affected systems, with roles written down beforehand.
Evidence is collected with a chain of custody. Between the second and fourth hours you find out what was encrypted and what was taken.
You restart from a cleaned environment, with new credentials and backups that predate the intrusion.
Senior management decides on the ransom, with legal counsel, after checking international sanctions.

Frequently asked questions

Should computers hit by ransomware be switched off?

As a rule, no. They are disconnected from the network and left on, because their memory holds traces that are useful for the analysis. CISA’s #StopRansomware Guide reserves switching off for devices that cannot be disconnected, to stop the spread. Either way, nothing is reinstalled or deleted before the evidence has been collected.

When do the 24 hours under NIS2 start?

From the moment the company becomes aware of a significant incident, not from when the attack began. The early warning must be sent to CSIRT Italia within 24 hours, the notification within 72 hours and the final report within one month, under Article 25 of Legislative Decree 138/2024 (Italy’s NIS2 law).

Can you pay the ransom?

Paying does not guarantee that the data will be recovered or deleted, and it may breach international sanctions if the recipient has been sanctioned by the European Union or by other countries. That is why the choice lies with senior management, after legal advice. The insurer and the authorities are informed, and the alternatives considered are documented.

When can a cleaned system go back on the network?

When the specialists have found the point of entry and closed it, the exposed credentials have been changed and the system has been rebuilt from a backup that predates the intrusion. Putting it back earlier often means reopening the same door. The restart proceeds in stages, checking systems one at a time.

Strategic’s Cybersecurity division writes the plan, assigns the roles and rehearses them with management, then supports the company in handling the incident and in the forensic analysis. For the public side of the crisis there is our Communication and intelligence division. The contact form on this site is not an emergency channel. During an incident, rely on the contacts written in your own plan and on the authorities.

Sources

Consulted on 16 September 2026.

Find out moreCybersecurityTesting carried out the way an attacker would (penetration tests), incident management, business continuity and support in meeting NIS2 requirements, suppliers included.