In the first 48 hours of a ransomware attack, the priorities are to contain the spread, preserve evidence, understand what was accessed, and meet legal obligations. Do not rush to wipe systems or pay a ransom. A calm, planned response protects recovery and any later investigation, insurance claim or regulatory notification.
Hour Zero: Contain the Attack, Do Not Panic
The first few hours of a ransomware incident can determine how far the attacker gets and how difficult recovery becomes.
The instinct may be to shut everything down, wipe infected machines and start restoring backups immediately. That can be counterproductive. Removing systems from the network may be necessary to stop the spread, but indiscriminately wiping or rebuilding compromised devices can destroy evidence that investigators need to understand the attack.
The immediate objective is containment.
Isolate affected systems and devices from the network. Disconnect compromised endpoints where appropriate. Disable accounts that are known or strongly suspected to be compromised. If ransomware is spreading through shared drives, consider disconnecting those resources from affected systems.
At the same time, preserve evidence. Keep relevant logs, ransom notes, suspicious files and system images where possible. Record what happened, when it was detected, which systems were affected and what actions were taken.
Do not assume that the systems displaying encryption are the only systems compromised. Modern ransomware incidents can involve a period of attacker activity before encryption begins. Attackers may have obtained credentials, established persistence, moved laterally and accessed sensitive information before deploying ransomware.
The Australian Signals Directorate’s Australian Cyber Security Centre recommends a structured response and recovery process rather than treating ransomware simply as a file recovery exercise.
Assemble the Response Team
Ransomware recovery is not solely an IT problem.
The response should bring together the people who can make decisions across technology, legal, communications, insurance and business operations.
Depending on the organisation, that may include:
- IT and infrastructure teams
- Security personnel
- Executive leadership
- Legal counsel
- Privacy or compliance teams
- Cyber insurance representatives
- External incident response and forensic specialists
- Communications and public relations teams
- Relevant third-party providers
If you have a pre-agreed incident response provider, contact them immediately. A 24/7 cyber incident response capability can help establish priorities, investigate the compromise and coordinate containment while internal teams concentrate on keeping critical business operations running.
Your insurer should also be contacted according to the requirements of your policy. Some policies require approval before engaging particular providers or taking certain actions.
This is one reason an incident response plan should exist before an incident happens. During a ransomware event, nobody should be debating who has authority to isolate systems, who contacts the insurer or who communicates with regulators.
Understand What Actually Happened
Once immediate containment is underway, the next priority is establishing what happened.
There are several questions that need answers:
How did the attacker get in?
Was the initial access caused by phishing, stolen credentials, an exposed remote access service, an unpatched vulnerability or a compromised third party?
How far did the attacker move?
Determine which accounts, endpoints, servers and network segments were accessed.
What information was accessed?
Ransomware is no longer necessarily about encryption alone. Attackers may steal information before encrypting systems and then use the stolen data to increase pressure on the victim.
Was data exfiltrated?
This question is particularly important because the consequences of a ransomware attack can continue even after systems have been restored.
A forensic investigation should establish, as far as reasonably possible, the timeline of attacker activity, affected systems, compromised accounts and potential data access.
Do not rely solely on the ransom note or information supplied by the attacker. Treat claims about stolen data as allegations until they can be assessed against your own evidence.
Understand Your Legal and Regulatory Duties
The first 48 hours also have a legal dimension.
Australian organisations need to determine whether the incident triggers notification or reporting obligations based on their circumstances.
Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act need to assess whether unauthorised access to or disclosure of personal information is likely to result in serious harm. The OAIC states that an organisation must take reasonable steps to complete an assessment within 30 calendar days after becoming aware of the relevant grounds or information.
That does not mean an organisation should simply wait 30 days. The OAIC expects assessments to be conducted reasonably and expeditiously, with the 30-day period treated as a maximum where possible.
There is also a specific Australian ransomware payment reporting regime.
Under section 27 of the Cyber Security Act 2024, certain reporting business entities must report ransomware or cyber extortion payments within 72 hours of making the payment, or becoming aware that another entity made the payment on its behalf. The regime applies to businesses carrying on business in Australia with annual turnover of at least AUD $3 million, as well as certain critical infrastructure entities.
Other obligations may apply depending on your industry, the systems affected and whether you operate critical infrastructure.
This is why legal and regulatory advice should be brought into the response early rather than after technical recovery has already begun.
The Ransom Question
One of the most difficult decisions can be whether to pay the ransom.
There is no simple technical answer because payment does not turn ransomware recovery into a guaranteed process.
Paying does not guarantee that systems will be restored. It does not guarantee that stolen information will be deleted. It does not necessarily prevent the attacker from returning.
The ACSC explicitly advises organisations not to pay a ransom, noting that payment does not guarantee access to information will be restored or prevent stolen information from being published or sold.
There may also be reporting and legal considerations associated with a payment.
Most importantly, ransom payment should never be treated as the recovery plan.
A recovery plan should still account for containment, forensic investigation, credential resets, remediation and restoration from trusted backups.
Recover From Clean Backups
Once the environment has been contained and investigators have enough information to understand the attack, recovery can begin.
The goal is not simply to get systems running again. It is to restore them without giving the attacker the same access again.
That means identifying and closing the original entry point before restoring affected systems.
Credentials may need to be reset. Compromised administrative accounts may need to be disabled or rebuilt. Vulnerable software may need to be patched. Persistence mechanisms need to be removed. Network access may need to be restricted.
Backups should also be treated carefully.
A backup connected to the compromised environment may have been encrypted or otherwise compromised. The ACSC recommends checking that backups are free from ransomware before using them for restoration.
A clean restoration should therefore be accompanied by validation that the environment is no longer compromised.
The First 48 Hours Should End With a Clearer Picture
By the end of the first 48 hours, you may not have everything solved.
You should, however, have a much clearer understanding of:
- What systems are affected
- How the attacker gained access
- Whether the attacker moved laterally
- Which accounts may be compromised
- Whether data may have been accessed or exfiltrated
- What containment measures are working
- Which regulatory obligations may apply
- Whether clean backups are available
- What needs to happen before restoration
- Who is responsible for each next step
That information creates the foundation for recovery.
The mistake is treating the first 48 hours as a race to make the ransomware disappear. The objective is to contain, investigate, recover and prevent reinfection.
What Happens After Recovery?
Restoring systems does not mean the incident is over.
Once operations are stable, conduct a post-incident review. Identify the control that failed and the conditions that allowed the attacker to progress.
That might be a compromised account with excessive privileges, an unpatched internet-facing system, inadequate network segmentation, insufficient endpoint visibility or backups that were not properly isolated.
The recovery phase should therefore lead directly into remediation.
An incident response retainer can also help organisations prepare before an incident occurs, with agreed response arrangements and access to specialist support when an incident happens.
The most valuable outcome of ransomware recovery is not simply getting the business back online. It is making sure the same path cannot be used again.
How Intrix Can Help
Intrix helps Australian organisations prepare for, respond to and recover from cyber incidents.
Our 24/7 cyber incident response services provide access to specialist support when a ransomware incident requires immediate containment, investigation and recovery assistance.
For organisations that want to establish response capability before an incident occurs, an incident response retainer provides a pre-agreed pathway to specialist response support.
Preparing before ransomware strikes means your team does not have to work out what to do while systems are already being encrypted.
Frequently Asked Questions
What should you do first in a ransomware attack?
The first priority is to contain the spread while preserving evidence. Isolate affected systems, disable compromised accounts where appropriate and avoid wiping or rebuilding devices before evidence has been preserved. Bring in your incident response team and establish what systems and accounts may be affected.
Should you pay the ransom?
Paying a ransom is risky and does not guarantee that systems will be restored or stolen data will remain private. The ACSC advises against paying ransomware demands. Organisations should instead focus on containment, investigation, clean backups and recovery, while obtaining appropriate legal and regulatory advice.
Do you have to report a ransomware attack in Australia?
A ransomware incident may trigger different reporting obligations depending on the circumstances. Personal information breaches that are likely to cause serious harm may fall under the OAIC’s Notifiable Data Breaches scheme. Certain ransomware or cyber extortion payments must also be reported within 72 hours by entities covered by Australia’s mandatory payment reporting regime.
How do you recover from ransomware?
Recover from clean, trusted backups only after containing the incident and addressing the attacker’s entry point. Investigate compromised accounts, systems and data access, remove persistence, patch vulnerabilities and validate the environment before reconnecting restored systems. Recovery should also include a review of the controls that allowed the attack to occur.
