The ransom note appeared on Monday morning. IT was notified at 6:12am. By 9am it was clear: servers encrypted, backups inaccessible, attackers demanding €450,000 in cryptocurrency. The forensics team established the initial access date: 19 days earlier. The attackers had spent three weeks mapping systems, identifying backups, establishing persistence — before executing the encryption.
The company had backups, a DR plan, and cyber insurance. What they didn't have was a tested IR plan, clean offline backups, or any detection capability. Recovery took 11 weeks. Total cost: over €2 million.
Why Most Ransomware Response Plans Fail
The plan was never tested. A plan that exists only in a document is a hypothesis, not a plan.
The backup strategy assumes clean backups. Modern ransomware specifically targets backup infrastructure — VSS shadow copies, backup catalogues, backup admin consoles.
Containment triggers are undefined. Who has authority to take systems offline? Without clear decision authority, organisations lose hours to internal discussions while the attack progresses.
No communication plan. NIS2 requires notification within 24 hours for significant incidents. Most organisations couldn't meet that timeline without a pre-prepared framework.
The First 72 Hours
Hours 0-4: Confirm the incident. Activate IR team. Begin network segmentation. Take forensic images before remediation. Contact cyber insurance — required for most policies.
Hours 4-24: Achieve network containment. Assess backup integrity — are backups truly clean and offline? Begin scope assessment. Engage external IR firm. Preserve logs for forensics and regulatory proceedings.
Hours 24-72: Decide: negotiate, restore, or rebuild. Verify backup integrity before restoration. Begin regulatory notification assessment (NIS2, GDPR). Start root cause analysis.
The Backup Strategy That Actually Works
The 3-2-1-1 rule: three copies, two media types, one offsite, one offline/air-gapped. The offline copy is critical — ransomware cannot encrypt what it cannot reach. Additionally: immutable backups, separate credentials from your domain, and regular restoration tests (not just backup job success alerts).
What Not to Do
Do not pay without legal advice. Payment may violate sanctions regulations. It may not result in working decryption tools. It puts you on a list of organisations that pay.
Do not wipe systems before forensics. You need the evidence for root cause analysis, regulatory reporting, and insurance claims.
Do not assume clean systems are clean. Attackers establish multiple persistence mechanisms during the dwell period.
Building Actual Readiness
Ransomware readiness requires tested IR plans (tabletop exercises annually), tested backup restoration (full restores, not just job success), detection capability (EDR, SIEM, network monitoring), a pre-negotiated IR retainer, and pre-drafted communication templates.
