In the first hours of a ransomware attack, the sequence is to isolate affected systems without shutting them down, activate the crisis committee, preserve evidence, determine how far the attack spread, verify backup integrity, and only then decide how to recover. Restoring systems before understanding what happened is the mistake that prolongs an incident the most.
Modern ransomware combines two forms of extortion: the attacker encrypts data to stop operations and, increasingly, copies it first to threaten publication. This content provides technical and management guidance and does not replace legal counsel's advice on mandatory notifications.
The numbers help convey the scale of the problem. The FBI identified 63 new ransomware variants in 2025, and the M-Trends 2026, from Google Cloud, shows that a prior compromise was the most common entry vector in ransomware cases, present in 30% of them. In Brazil, the ANPD recorded 723 security incident notifications between the second half of 2023 and the first half of 2025.
Hours 0 to 1: contain without erasing evidence
Disconnect affected devices from the network, including wired, Wi-Fi, and VPN connections, without turning them off: memory holds evidence lost during shutdown. Segment the network, suspend connections between sites, and stop third-party remote access to contain the spread.
Sever every connection between the attacked environment and backups, which are usually among the first targets. And do not contact the attacker before a formal decision has been made.
Hours 1 to 4: who decides and with what information
Decisions about communications, payment, operational shutdowns, and third-party involvement belong to the crisis committee. If the company has a continuity plan, it identifies these people. Open a communication channel outside the compromised environment, because corporate email and chat may be compromised.
Engage your SOC or incident response provider and, if you have cyber insurance, notify the insurer early, because many policies require prompt notification. Start an incident log recording the time, action, owner, and decision.
Hours 4 to 24: understanding the incident's scale
Determine which systems were encrypted, how the attacker entered, how long they had been in the environment, and which accounts they used. Initial access often occurred days or weeks before encryption. Look for signs of data copying, because restoration resolves the outage but not the breach.
Test backups before trusting them: verify their integrity, confirm they predate the attacker's entry, and ensure they do not contain the same malicious artifact. Rotate administrative and service credentials from clean devices.
Hours 24 to 48: communicate and begin recovery
If personal data is involved, the LGPD requires notification to ANPD and to data subjects when the incident could cause significant risk or harm, and ANPD regulations establish a deadline of three business days. Regulated sectors have additional obligations. File a police report and prepare communications for customers and employees.
The restoration sequence should follow the process criticality defined in the business impact analysis, as shown in the article on business continuity. Keep monitoring active, because the attacker may have left backup access paths.
Whether to pay the ransom
There is no universal answer, but the committee needs to consider several facts. Paying does not guarantee a key, that it will work, or that copied data will be deleted. Legal restrictions may apply depending on the attacking group, and companies that pay are often attacked again. The strongest negotiating position is a working backup, built before the attack. CISA maintains a public ransomware guide.
What determines an incident's duration
In Vultus's 2026 Cyber Risk Landscape, a study of 132 organizations, only 23% had a structured continuity process, and simulated attacks had an average impact of 8.28 on a scale from 0 to 10. Prior preparation matters more than attack sophistication:
- Isolated backup: separate from the production environment, with tested restoration.
- Defined priorities: what to restore first, according to the BIA.
- Roles with designated alternates: who decides, even when the primary owner is absent.
- Alternative channel: communication outside corporate infrastructure.
- Post-incident analysis: where attackers entered, why they were not detected, and what the plan failed to anticipate.
Preparation before the incident
Vultus supports preparation through continuity planning, crisis simulations, and continuous monitoring. Explore Vultus crisis management and business continuity and the Vultus SOC by Google SecOps.
