What to Do in the First Hour After Ransomware Hits

At 8:40 on a Monday morning, an operations manager at a 70-person company cannot open the shared drive. A colleague reports a strange text file on her desktop. Within minutes, three more people say the same thing, and someone asks whether the phones are down too.

The next 60 minutes will not decide everything, but they will shape how long the company is down and how much has to be rebuilt. This post walks through that hour in order, using public guidance from CISA and the FBI, so a leadership team can read it before it needs it.

Why the first hour matters

Ransomware is built to spread. Once an attacker has a foothold, the software moves across file shares and connected systems, encrypting data as it goes. Every minute an infected machine stays on the network is a minute more files can be locked.

Small and mid-sized companies are not an afterthought for attackers. The Verizon 2025 Data Breach Investigations Report found ransomware present in 88% of breaches at small and medium-sized businesses, compared with 39% at larger organizations. Verizon's analysts also noted that part of that gap reflects a larger share of small-business data in the 2025 sample, so treat the exact figure with some care. The direction is still clear: this is a mid-market problem.

The same report put the median ransom payment at $115,000 and found that 64% of victims did not pay. For a company of 70 people, a six-figure payment is a large, unplanned expense, and paying does not guarantee the data comes back or that the attacker leaves. The FBI does not encourage paying a ransom, partly because payment funds further attacks and does not ensure recovery.

Minutes 0 to 10: confirm and contain

The first job is to stop the spread, not to understand the whole attack.

Disconnect affected machines from the network. Unplug the network cable or turn off Wi-Fi on any computer showing ransom notes, renamed files, or locked folders. CISA's ransomware guidance puts isolation first. If you cannot disconnect a machine from the network, CISA's checklist says to power it down as a fallback to limit the spread.

Do not power off machines you can safely disconnect. A running machine can hold evidence in memory that a forensic team needs to learn how the attacker got in. Disconnecting is usually better than shutting down.

Do not wipe or reinstall anything yet. The urge to "just rebuild it" is strong. Resist it until someone has captured what is on the machine.

Take backups offline. If backup systems are reachable from the network, disconnect them from it now. Attackers often look for backups first, and a backup that is encrypted along with everything else is no longer a backup.

Use a different channel to talk. If email or chat may be compromised, an attacker can read your response plan as you write it. CISA advises coordinating over out-of-band channels such as phone calls, so the attacker is not alerted. A text thread among the leadership team on personal phones works.

Minutes 10 to 25: call the right people, in order

Most companies lose time here because nobody is sure who is in charge. Write the call order down in advance. In the moment, it looks like this:

The incident lead. One person makes decisions and keeps the log. At a company without a CISO, this is usually the COO or CEO, with a security provider advising.
Your security provider or IT provider. They can see what is connected, what is encrypted, and what is still clean.
Your cyber insurance carrier. Most policies include a breach hotline and a panel of approved forensic and legal firms. Many policies require notice quickly, and using vendors outside the panel can put coverage at risk. Read the notification clause before you need it.
Outside counsel. Ransomware often triggers legal questions about client contracts and breach notification. Counsel can also direct forensic work in a way that helps protect privileged communications.
Law enforcement. CISA and the FBI ask victims to report ransomware incidents. A report to your local FBI field office or through the Internet Crime Complaint Center does not slow your recovery, and it can help others.

Minutes 25 to 45: scope the damage and preserve evidence

With the spread contained and the right people on the phone, the goal shifts to understanding what happened. Do not try to do this alone, and do not guess.

Identify which systems are affected. A security team will look at which accounts and machines show signs of encryption, which servers are still clean, and whether the attacker used a valid employee login. Stolen logins are a common way in, which is why identity logs matter so much.

Preserve logs and screenshots. Save the ransom note, take photos of screens, and keep a time-stamped list of what you observed and what you did. This record supports the insurance claim, any legal notification, and the forensic work.

Check whether data was taken. Many ransomware groups copy data before encrypting it, then threaten to publish it. The question "was anything stolen?" decides whether you have notification obligations to clients, patients, or regulators, so it needs an answer from a qualified investigator, not a guess.

Reset credentials carefully. Resetting passwords on compromised accounts is necessary, but doing it before the attacker is out can tip them off or lock investigators out of evidence. Your response team should sequence this.

Minutes 45 to 60: decide, communicate, and start recovery planning

By the end of the hour, you should have a short list of decisions in hand.

Confirm what is recoverable from backups. Check the date of the last clean backup and whether it has been tested by restoring from it. A backup that has never been restored is an assumption, not a plan.

Decide on operations. Can the business run on paper, phones, or a reduced set of systems for a day or two? Naming the minimum viable operation tells your team what to restore first.

Tell staff what to do and what not to do. A short message, sent over a trusted channel, is enough: do not turn machines back on, do not open the ransom note links, do not talk to the attacker, and send questions to one named person.

Hold off on the ransom question. Whether to pay is a business, legal, and insurance decision that should not be made in the first hour. Gather facts first.

A short checklist to keep

Print this and put it with your insurance policy:

Disconnect affected machines from the network, and keep them powered on if you can.
Disconnect backup systems from the network.
Move leadership communication to phone calls or text.
Call your security provider, your cyber insurance carrier, and counsel, in that order.
Do not delete, wipe, or reinstall anything.
Keep a time-stamped log of every action.
Report the incident to the FBI or CISA.
Check the last clean, tested backup.

What an hour looks like with a security team in place

The hour above is hard when you are doing it for the first time with no one to call. It goes differently when someone is already watching.

Example engagement: a 70-person professional services firm has Elevaire Managed Security on the Plus package. Endpoint monitoring flags a machine that is renaming files at an unusual rate. Elevaire would isolate that machine from the network, check the identity logs for the account involved, confirm the backups are untouched, and brief the firm's leadership and its existing IT provider with a written timeline. The firm's own staff would handle only the decisions that belong to the business.

That is the difference a managed approach makes. The tools are already in place, the call list is already written, and the people involved have done it before. Elevaire Managed Security works alongside a company's existing IT provider, so the IT team keeps handling systems and users while security detection and response sits with a team focused on it. The Plus and Complete packages include 24/7 detection and response, while Essentials covers business-hours response. The step-by-step process is described in what happens when we detect a threat.

Prevention shortens the hour too. Application allowlisting, multi-factor sign-in, email filtering, and tested backups reduce how often a company ends up here at all. The security baseline checklist for growing companies lists the controls worth checking first.

Frequently Asked Questions

Should I shut down all my computers when ransomware hits?

Not by default. Disconnecting affected machines from the network usually does more good, because it stops the spread while preserving evidence held in memory. CISA's checklist suggests powering a system down only when you cannot disconnect it from the network. Ask your security provider before turning off servers.

Should we pay the ransom?

Decide that with your insurer, counsel, and incident response team, not in the first hour. The FBI does not encourage paying, since payment does not guarantee you get data back and it funds further attacks. In the Verizon 2025 report, 64% of victims did not pay.

How much does a ransomware recovery cost for a company our size?

Costs vary widely with downtime, how many systems are affected, and whether data was stolen. Verizon's 2025 report put the median ransom payment at $115,000, and that figure leaves out downtime, forensics, legal fees, and lost business. Elevaire Managed Security is sold on predictable monthly pricing with no hourly billing, so the cost of having help during an incident is known in advance.

How does this work if we already have an IT provider?

Elevaire works alongside your existing IT provider or internal team and does not replace them. Your IT team keeps running systems, users, and day-to-day support. Elevaire handles security monitoring, response, and the coordination with your insurer and counsel when something goes wrong.

How do I get started before an attack happens?

Start with three things: confirm your backups restore, write down the call list above, and read your cyber insurance policy's notification clause. A security review can then show where the gaps are and which controls to add first.

Do we have to report a ransomware attack?

CISA and the FBI ask victims to report. Separate legal notification duties depend on your industry, your contracts, and whether personal data was taken. Counsel can tell you which apply.