Ransomware: what to do in the first 24 hours

This guide is for security leaders, IT teams, executives and board members who need a clear sequence of actions if ransomware strikes. It covers the first 24 hours: who to call, how to contain the attack without destroying evidence, how to make decisions under pressure and which UK bodies to report to.

Print it, or keep a copy somewhere that does not depend on your corporate network. During a ransomware incident, your usual systems, documents and contact lists may be unavailable, and that is exactly when you will need them.

#What should you do in the first hour of a ransomware attack?

In the first hour, call your insurer's incident line first if you have cover, activate your incident response plan and start containing the attack by isolating affected systems. Set up a small decision-making group, move to communication channels the attacker cannot see, and begin a written log of everything you find and decide.

1. Call your insurer's incident line first if you have cover. Your policy may set conditions on how and when you notify, and may give access to specialist responders. The NCSC's ransomware payment guidance advises reporting the attack to your insurer or broker if you have cyber insurance.
2. Activate your incident response plan. Use your playbook if you have one, and established incident management structures where possible.
3. Contain, carefully. Disconnect affected systems from the network to limit spread. Do not wipe or rebuild anything yet.
4. Switch to out-of-band communications. Assume corporate email and chat may be unavailable or monitored by the attacker.
5. Start an incident log. Record what was found, when, what was decided and why.
6. Do not engage with the attackers or respond to any demand until you have taken advice.

Keep the tone calm. The NCSC's guidance on immediate activities asks leaders to keep a calm, professional tone, avoid rushing to judgement and support their staff. It notes that attackers in ransomware and extortion cases may deliberately seek to increase pressure in order to influence decision-making.

#How do you contain ransomware without losing evidence?

Contain ransomware by isolating affected systems from the network rather than wiping them, disabling compromised accounts and blocking known attacker access. The NCSC notes that disconnecting can limit spread and preserve forensic evidence, while shutting systems down may lose evidence. Make these decisions with your incident responders and record the reason for each one.

The NCSC sets out the trade-off plainly. Disconnecting systems can limit spread and preserve forensic evidence, but may not stop malicious activity already under way. Shutting systems down can halt processes, but may result in loss of investigative evidence. There is no single right answer for every system, which is why expert advice matters early.

#Containment checklist

• Isolate affected devices and servers from the network, including wireless and remote access connections.
• Disable or reset accounts you believe are compromised, starting with administrator accounts.
• Protect backups: confirm they are disconnected and restrict access to backup systems.
• Preserve logs from firewalls, servers, cloud services and security tools before they are overwritten.
• Photograph or save ransom notes and any messages from the attackers.
• Do not delete, wipe or rebuild systems until your investigators agree.

#Who should lead the response, and who makes the decisions?

A small incident command group with clear authority should lead the response, typically headed by the chief executive or another senior executive, with technical, legal, communications and operational leads. The NCSC advises establishing a clear governance structure to direct and coordinate the response. Agree early who can make major decisions, such as taking services offline.

Bring in specialist help early. The NCSC recommends engaging a Cyber Incident Response provider assured by the NCSC, and allowing sufficient time and access for the investigation. If you have cyber insurance, your insurer may have its own panel of responders, which is another reason to call the incident line first.

• Incident lead: a senior executive with authority to make business decisions.
• Technical lead: coordinates internal IT, security and external responders.
• Legal and data protection: assesses notification duties, contracts and evidence handling.
• Communications: manages messages to staff, customers, partners and media.
• Operations: keeps critical services running using workarounds.
• Record keeper: maintains a single, authoritative record of findings, decisions and actions.

#Which UK bodies should you report a ransomware attack to?

Report the attack to the police through Report Fraud, which has replaced Action Fraud in England, Wales and Northern Ireland, and to the NCSC. In Scotland, contact Police Scotland on 101. If personal data is affected and the breach is likely to risk people's rights and freedoms, notify the ICO without undue delay and within 72 hours of becoming aware.

#Report Fraud (police)

The City of London Police confirms that Report Fraud has replaced Action Fraud for England, Wales and Northern Ireland. Its reporting guidance says a business, charity or organisation under a live cyber attack should call 0300 123 2040 immediately, and that this service is available 24 hours a day, 7 days a week. You can also report online at reportfraud.police.uk.

#The NCSC

Report the incident to the NCSC through its incident reporting service. The NCSC's guidance notes that it is not a regulatory body and will not pass information to regulators without first seeking your consent. Reporting to the NCSC does not satisfy legal reporting duties, so the NCSC points organisations to its Cyber Incident Signposting Service to identify other obligations.

#The ICO

Under UK GDPR, if a personal data breach is likely to result in a risk to people's rights and freedoms, you must report it to the ICO without undue delay, and not later than 72 hours after becoming aware of it. The ICO's guide explains that you can provide the required information in phases if you do not yet have all the details. If the risk to individuals is high, you must also tell them directly and without undue delay. Record all breaches, whether or not you report them.

#Insurers, regulators and contracts

The NCSC advises checking early for reporting deadlines and identifying requirements set by others, such as cyber insurers. Check your sector regulator's rules and any notification duties in contracts with customers and partners.

#Should you pay the ransom?

Law enforcement does not encourage, endorse or condone paying ransoms, and the decision should never be rushed in the first hours. The final choice rests with the victim, so take advice from your insurer, responders and lawyers, explore alternatives and record your reasoning. Payment may also be unlawful if it benefits a sanctioned entity.

The NCSC's guidance for organisations considering payment, produced with the ABI, BIBA and IUA, sets out the steps. Do not panic. Review alternatives first, including whether usable backups exist. Involve technical staff and senior decision-makers. Assess the impact on operations, data and finances. Investigate the root cause, and do not accept attackers' claims at face value. It also warns that you cannot trust a promise to delete stolen data once a ransom is paid.

Paying does not remove your regulatory duties. The same guidance notes that the ICO does not treat a payment to attackers as a way of reducing the risk to individuals, and that paying would not reduce any penalty.

#What should you do between hour two and hour 24?

Between hour two and hour 24, focus on understanding the scope of the attack, protecting what still works and planning a safe recovery. Triage critical services, confirm the state of your backups, complete your regulatory and contractual assessments, and communicate clearly with staff and stakeholders. Keep the incident log current throughout.

1. Triage: identify critical business functions, affected and working systems, dependencies and the status of backups.
2. Agree minimum viable operations: the smallest set of services needed to keep critical functions running.
3. Confirm whether the attacker has been contained before reconnecting anything.
4. Complete the ICO risk assessment, remembering that the 72-hour clock runs from when you became aware of the breach.
5. Brief staff on how to work without affected systems and what not to say externally.
6. Prepare holding statements for customers, partners and, if needed, the media.
7. Hold regular command meetings and keep the central record up to date.

The NCSC stresses that early communication helps reduce confusion and conflicting messages, and that a single, authoritative record helps ensure all teams work from the same understanding. Its initial stakeholders include technical and security leads, legal advisers, executives and customer relationship managers.

#What to do next: prepare before an attack happens

Prepare now by writing a short ransomware playbook, storing key contacts offline, testing backup restores and exercising your plan with executives. Record your insurer's incident line, your incident responders and the reporting routes in this guide where staff can reach them during an outage. Rehearsal turns a stressful first hour into a practised routine.

Keep an offline incident pack containing:

• Your insurer's incident line and policy number, if you have cover.
• Contact details for your incident response provider, lawyers and communications advisers.
• Report Fraud: 0300 123 2040. Police Scotland: 101.
• The ICO reporting route and your data protection lead's details.
• Network diagrams, a list of critical systems and your agreed recovery order.
• Out-of-band communication arrangements for the incident team.

Dealing with a live incident now? Call your insurer's incident line first if you have cover, then follow your incident response plan. Businesses, charities and organisations under live attack in England, Wales and Northern Ireland can call Report Fraud on 0300 123 2040.

#Frequently asked questions