In the first 24 hours, isolate infected devices immediately (disconnect them, but don't power off), preserve evidence, activate your incident response plan, and notify law enforcement through CISA and the FBI. Do not pay the ransom yet. Call your cybersecurity partner or RedCore before making any irreversible decision.
The clock started the second the ransom note appeared. What you do in the next 24 hours — most of it in the first 60 minutes — will shape your recovery cost, your legal exposure, and whether your data ever comes back.
Ransomware isn't rare, and it isn't only a "big company" problem. Sophos's State of Ransomware 2024 report found that 59% of surveyed organizations were hit by ransomware in the past year, and the average recovery cost — excluding any ransom paid — reached $2.73 million. For a small or mid-sized business, the response you run today is the difference between a bad week and a closed business.
What's the very first thing I should do when I discover ransomware?
Isolate the infected machines — but do not power them off.
- Unplug the network cable and disable Wi-Fi on affected devices right away.
- Powering off can wipe memory-resident evidence and encryption keys that forensics teams (or free decryptors) may need.
- Disconnect shared drives, external backups, and cloud-sync clients so the encryption can't keep spreading.
"Every minute a compromised machine stays on the network is a minute the attacker uses to spread — isolation beats investigation in the first hour," says the RedCore incident response team at RoboZilla.
How do I contain the attack without making it worse?
Containment means stopping lateral movement while preserving your ability to recover.
- Segment the network — pull the affected VLAN or subnet, not just one laptop.
- Disable compromised and privileged accounts, and force-reset credentials for domain admins.
- Preserve, don't clean. Resist the urge to delete files or reimage machines — you'll destroy evidence and possibly your recovery path.
- Snapshot the logs — firewall, VPN, endpoint, and Active Directory logs are gold for finding the entry point.
This mirrors NIST Special Publication 800-61, the Computer Security Incident Handling Guide, which sequences response as detection → containment → eradication → recovery. Jumping straight to recovery is the most common — and costliest — mistake.
Who do I need to notify in the first 24 hours?
Ransomware is a crime, and handling it quietly can violate your obligations. Within 24 hours, notify:
- CISA — report at CISA.gov; their #StopRansomware Guide (CISA and FBI) is the authoritative U.S. playbook.
- The FBI — file at the Internet Crime Complaint Center (IC3.gov). The FBI can sometimes match your strain to a known decryptor.
- Your cyber-insurance carrier — most policies require prompt notice, and late reporting can void coverage.
- Legal counsel — to assess breach-notification duties for customer, payment, or health data.
Takeaway: Loop in your cybersecurity partner before you touch anything irreversible. RoboZilla's RedCore team can be engaged on day one to run containment and forensics alongside these agencies.
Should I pay the ransom?
Not as a first move — and ideally not at all. Both the FBI and CISA advise against paying, because payment funds criminal operations, flags you as a willing target, and guarantees nothing.
- Paying doesn't guarantee recovery — the FBI notes some victims never receive a working decryption key even after they pay.
- Payments to sanctioned groups can expose you to U.S. Treasury (OFAC) penalties.
- The real cost dwarfs the ransom: IBM's Cost of a Data Breach Report 2024 put the global average breach cost at $4.88 million, and Verizon's 2024 Data Breach Investigations Report tied ransomware and extortion to 32% of all breaches.
Let a professional negotiator and your insurer weigh in first. Waiting a day is almost always reversible; paying never is.
How do I preserve evidence and start recovery?
- Locate clean backups and confirm they weren't encrypted or connected during the attack.
- Rebuild on clean hardware or images, not the compromised systems.
- Identify the strain from the ransom note and file extensions, then check NoMoreRansom.org for a free decryptor.
- Document a timeline — when, what, and who — for insurers, regulators, and future prevention.
Recovery is also where prevention begins: hardening identity, patching the entry point, and deploying monitoring so it doesn't happen twice. This is exactly where RoboZilla's RedCore cybersecurity service — paired with automation that keeps patching and backups running without human forgetfulness — keeps you out of the next headline.
"The businesses that survive ransomware aren't the ones with the best luck — they're the ones who rehearsed the first hour before it ever happened," says RoboZilla's RedCore team.
FAQ
How fast does ransomware spread?
Modern strains can encrypt an entire network in hours. That's why isolation in the first minutes — not the first day — matters most.
Will my cyber insurance cover a ransomware attack?
Often yes, but only if you follow policy terms: prompt notification, no unauthorized ransom payment, and cooperation with approved responders. Read your policy before an incident.
Do I legally have to report a ransomware attack?
It depends on your industry and the data involved. If customer, health, or payment data is exposed, breach-notification laws likely apply — consult counsel immediately.
Can data really be recovered without paying?
Frequently, yes — through clean backups or a free decryptor at NoMoreRansom.org. That's why preserving systems and evidence beats rushing to pay.
What's the single most important prevention step?
Tested, offline backups plus monitored endpoints. Most damage comes from spread and downtime — both of which good detection and segmentation prevent.
About RoboZilla — RoboZilla delivers enterprise-grade cybersecurity (RedCore), business automation, and AI lead generation built for small and mid-sized businesses. When every minute counts, RedCore helps you contain, recover, and harden fast. Call (877) 692-8992 or visit https://robozilla.ai.
RoboZilla — cybersecurity (RedCore), business automation & AI lead generation for small & mid-sized businesses. https://robozilla.ai · (877) 692-8992
Top comments (0)