Ransomware recovery checklist: the first hours and days after an attack

The worst time to write a ransomware plan is after the ransom note appears.

Ransomware recovery follows one order: stop the spread, keep the evidence, find out what was touched, rebuild from clean backups, and only then bring people back online. Disconnect affected systems first, call your incident response contacts, report the attack, and restore only from backups the attackers could not reach, after you are sure they are out.

Why the order matters in ransomware recovery

Recovery goes wrong when steps happen out of order: machines powered off before evidence is saved, or files restored into a network the attacker still controls. This checklist follows the #StopRansomware Guide from the Joint Ransomware Task Force, which CISA and the FBI co-chair (October 2023). Ransomware is common enough to plan for: the FBI’s 2025 Internet Crime Report logged more than 3,600 ransomware complaints, with reported losses above $32 million, a figure that leaves out lost business, downtime, wages, equipment and outside clean-up costs.

The first hour: stop the spread

Containment matters more than diagnosis in the first hour. Work through these steps in order.

1. Isolate what is affected. If several systems or subnets look hit, take the network offline at the switch. If you cannot, unplug the affected devices or remove them from Wi-Fi. For cloud servers, snapshot the volumes so investigators have a point-in-time copy.
2. Leave devices powered on if you can. Shutting a machine down erases the evidence held in its memory. Power it off only when you have no other way to disconnect it.
3. Switch to the phone. Attackers can watch your communications for signs they have been spotted, so coordinate by phone, outside the compromised network.
4. Keep the ransom note. Photograph it and leave the file where it is. Deleting it can make a later decryption impossible.
5. Protect the backups. Attackers try to find and delete or encrypt any backup they can reach. Confirm yours is intact, and do not log in to it from a machine that might be compromised.
6. Start a log. Write down the time, what you saw, who did what and who you called. Your insurer and any investigator will ask for it.

The first day: call the right people and keep the evidence

Once the spread has stopped, open your incident response plan and start making calls. If you do not have a plan yet, here is a sensible order.

• Your IT or security provider, so the technical work starts while you handle the business side.
• Your cyber insurer. Check your policy early: many require prompt notice, and some name the responders you must use.
• Legal counsel. Notification duties depend on what data was involved, and counsel should shape what you say and when.
• Law enforcement. CISA’s guide lists CISA, your local FBI field office, the FBI’s Internet Crime Complaint Center and your local Secret Service office. Ask about decryptors even if you plan to restore, because researchers sometimes release decryption tools for a variant.

Preserve evidence before anyone cleans up. The guide recommends a system image and a memory capture from a sample of affected devices, plus relevant logs and any malware samples. Ask early whether data was stolen as well as encrypted. Attackers often copy data first and threaten to publish it, a tactic known as double extortion, and that can trigger notification duties even if you restore every file.

The next few days: scope the damage before you restore

The temptation is to restore everything at once. Restoring into an environment the attacker still controls only hands them fresh files to encrypt.

• Rank your systems. Build a critical asset list: the systems that keep patients, customers and revenue moving, plus the systems they depend on. Restore in that order.
• Find the way in. Check VPN and remote access logins, new or newly privileged accounts, unexpected remote management tools and the email accounts involved. CISA warns that a ransomware event can sit on top of an earlier, unresolved compromise, so look for the precursor malware before you rebuild from backups.
• Close the doors. Disable the remote access paths the attacker used. Reset passwords only after the environment is clean and rebuilt, so the attacker cannot capture the new ones.
• Rebuild rather than trust a clean-up. Where you can, rebuild affected systems from standard images instead of hoping you found everything.

Ransomware recovery: restore in order, then keep watching

Ransomware recovery is a series of small, checked restores, not one big one.

1. Restore into a clean, isolated network segment. CISA’s example is a new VLAN for recovery that only clean systems may join.
2. Bring back identity systems first, because every other system trusts them, then work down your critical asset list.
3. Restore from offline, encrypted backups. Confirm each restore point predates the intrusion, then test the restored system before it reconnects.
4. Once the environment is rebuilt, reset passwords for affected systems, patch the weakness that let the attacker in, remove any persistence and update customer-managed encryption keys where needed.
5. Declare the incident over against criteria agreed in advance, not because the screens look normal.

Keep watching closely after you reconnect, in case a foothold was missed, and write down what went wrong while it is fresh. CISA’s guide asks teams to document lessons learned and update their plans.

Paying the ransom: what to weigh

CISA’s guide does not recommend paying. Paying does not mean your data will be decrypted, that the attacker is out of your systems or that your data will stay private, and it may carry sanctions risk under a September 2021 advisory from the US Treasury’s Office of Foreign Assets Control. The decision belongs to your leadership, with counsel and your insurer involved. It is far easier to make calmly when you have clean backups to fall back on.

How backups, isolation and incident response fit together

Three pieces decide how an attack ends, and each covers a weakness in the others.

• Isolation keeps one infected machine from becoming a network-wide outage and keeps backups out of the attacker’s reach. Without it, the attack reaches servers and backup storage before anyone reacts.
• Backups give you a clean point to return to. Without them, paying becomes the only way to get data back.
• An incident response plan decides who calls whom, what comes back first and when it is over. Without one, decisions get made under stress, one argument at a time.

Backups only count if attackers cannot reach them. CISA recommends offline, encrypted backups that you test regularly, and the FBI’s 2025 report adds that backups should be immutable and cover your whole data infrastructure. CISA also notes that automated cloud backups may not be enough on their own: if local files are encrypted, the encrypted versions can sync to the cloud and overwrite good data.

Our managed detection and response service watches endpoints and network activity around the clock, so the early signs of an intruder reach an engineer, ideally well before a ransom note reaches a screen. Our backup and disaster recovery service keeps separate, tested backups, so a failed server or an encrypted file share means a restore, not a rebuild from memory.

Before an attack: the short list worth doing this month

• Restore something for real. Pick one server and one shared folder, restore them to a clean location, and write down how long it took and what broke.
• Keep one copy out of reach. At least one backup should be offline or immutable, so no everyday account can delete it.
• Write a one-page plan. Names, phone numbers, your insurer’s claim line and the order systems come back. Keep a printed copy and an offline copy, as CISA advises.
• Turn on multi-factor sign-in for email, remote access and administrator accounts first.
• Practice once. CISA publishes ransomware tabletop exercise packages for walking your team through the plan.
• Train your people. Stolen passwords and social engineering are common ways in, which is why email security and awareness training belong in the plan.

What to do next

The quickest way to find out how ransomware recovery would go in your environment is the complimentary assessment. An engineer reviews your network, email and backups and ranks what to fix first. From there, backup and disaster recovery and managed detection and response cover both ends of this checklist: a clean point to return to, and early warning that something is wrong. We work from Cooper City and support organizations across Broward, Miami-Dade and Palm Beach counties. If an attack is under way now, call 954-443-0255 instead of using the form.

Frequently asked questions

How long does ransomware recovery take?

There is no honest fixed answer. It depends on how many systems were encrypted, whether your backups survived and are clean, whether the attacker still has access, and whether you wrote down a recovery order in advance. A rehearsed restore finds the problems before the incident does.

Should we pay the ransom?

CISA’s guide does not recommend it. Paying does not mean your data will be decrypted or kept private, and it can carry sanctions risk. Talk to counsel and your insurer before any decision, and ask law enforcement about decryptors first. Clean backups are the best way to make the question moot.

What if our backups were encrypted too?

Ask law enforcement whether a decryptor exists for the variant, then look for older copies the attacker could not reach, such as offline media, snapshots or cloud file versions. Rebuild the systems on your critical list first, and check each older copy for malware before you trust it.

Do we have to report a ransomware attack?

Law enforcement reports are strongly encouraged, and some organizations also have reporting or notification duties set by law, regulators, contracts or insurers. Florida’s breach law, Section 501.171 of the 2025 Florida Statutes, sets a 30-day deadline to notify affected individuals once a breach is determined, and HIPAA has its own rules for patient data. Ask your attorney early.

Written by the SNATEK engineering team, Cooper City, Florida. Managed IT, cybersecurity and cloud support for South Florida organizations since 1996.