Ransomware Incident Response: What to Do and What Not to Do

1. Introduction

Ransomware incident response is one of the most critical situations a business can face: encrypted systems, inaccessible data and a criminal group demanding a ransom. Every minute counts, and above all, the first actions determine whether the damage is manageable or catastrophic. In this article we explain what to do and what not to do when ransomware strikes, with an actionable step-by-step guide.

The data is clear: in 2026 the average detection time for ransomware is 2 to 5 days, and the average cost of an incident for an SME is around EUR 100,000 including business interruption, recovery and reputation. A well-executed ransomware incident response can drastically reduce that cost, while a poor response — rebooting servers, paying the ransom blindly or telling everyone — multiplies the disaster.

This article is designed for executives, IT managers and security teams: a 7-step guide with concrete actions, useful commands for the technical team and the list of fatal mistakes to avoid. Knowing how to respond calmly and methodically is the difference between recovering in days or losing weeks of business.

2. Ransomware in 2026: How It Operates

Modern ransomware rarely “magically” enters: it is installed after weeks of covert operations. The most common vectors are exposed RDP credentials, phishing with malicious attachments and exploitation of unpatched VPNs. Before encryption, the attacker exfiltrates data to apply double-extortion pressure.

Entry vector	% incidents	Early signal
Exposed RDP / remote access	35%	Anomalous login, night sessions
Phishing with malicious attachment	30%	Email alerts, macros
VPN/firewall exploitation	20%	Public CVE, connection logs
Supply chain / legitimate software	15%	Fake updates, signatures

Fig. 1 – Ransomware entry vectors and early detection signals.

Understanding the attacker’s cycle — access → lateral movement → exfiltration → encryption → extortion — lets you know where you stand and which actions are priorities in your ransomware incident response.

The ransomware economy has industrialized: most attacks in 2026 come from ransomware-as-a-service (RaaS) groups that buy the initial access from brokers and use automated tooling to escalate, steal data and deploy encryption at scale. Artificial intelligence accelerates the cycle too — phishing emails are more convincing and scanning is faster — leaving the defense less time to react.

3. Step 0: Before It Happens — Preparation

The best ransomware incident response starts before the incident. A tested response plan, immutable backups and defined roles reduce panic and speed up recovery:

# Monthly preparedness checks
# 1. Are there immutable backups outside the network?
#    - NAS with WORM, offline copy or cloud with immutability
# 2. Have we tested restoration this month?
#    - Restore 1 VM and 1 critical database
# 3. Is the response plan signed and tested in a drill?
# 4. Are emergency contacts (forensics, legal, insurance) up to date?

Fig. 2 – Monthly ransomware preparedness checklist.

Immutable backups are the only guarantee of recovery without paying. If the backup chain is vulnerable to the attacker’s encryption, your ransomware incident response starts with one hand tied.

4. Step 1: Immediate Containment (Minutes 0-30)

At the first sign of mass encryption or a ransom note:

Isolate without powering off: disconnect affected systems from the network while preserving memory evidence. Powering off loses critical forensic data.
Cut remote access: disable RDP and VPN, change critical administrator passwords.
Stop propagation: block the C2 domain (if known), disconnect shared segments.
Freeze backups: disconnect the backup repository from the network if it has not been reached yet.

Fig. 3 – Immediate containment actions in a ransomware incident.

At this stage, ransomware incident response depends on speed and on not touching anything without thinking. Every minute the encryption advances, more machines are compromised.

Practical details that make the difference in the first minutes: record the exact time of detection; disconnect only the affected segments, not the whole company; change all privileged account passwords; disable externally exposed RDP; and block the C2 domain at firewall and DNS if known. Keep a written log of every action.

5. Step 2: Assessment and Triage

Before restoring anything, answer: what is encrypted, what is not, and what has been exfiltrated? The technical team collects samples and logs:

# Initial evidence collection (authorized, preserving copies)
# 1. Capture a memory dump of the index system if it is safe
#    (only trained staff, with forensic tools)
# 2. Copy EDR/AV, SIEM and firewall logs from the previous period
# 3. Annotate the ransom note: family name, email, wallet
# 4. Check if the family is known: ID Ransomware, No More Ransom

Fig. 4 – Initial triage and evidence collection in ransomware response.

Identifying the ransomware family and the existence of free public decryptors (No More Ransom) can avoid paying an unnecessary ransom.

Build a quick inventory: machine name, role, encrypted or not, last known connection and backup status. Prioritize by criticality. Verify which systems were not affected — they are the recovery candidates — and confirm the backup repository is intact and still offline.

6. Step 3: Communication and Notification

Internal and external communication must be controlled: CEO, security officer and legal counsel in a closed channel. Avoid premature public announcements that alert customers without verified data. In the EU and Spain, personal data breach notification to the supervisory authority (AEPD) must be made within 72 hours if there is risk; also consider notifying INCIBE-CERT and law enforcement — and if you decide to report, do not destroy evidence.

A professional ransomware incident response includes deciding who talks to whom: the forensic provider, cyber insurance and the legal team working in parallel so effort is not duplicated or the investigation contaminated.

Prepare short message templates in advance: for employees, a factual message explaining that systems are being recovered; for customers, a confirmation of the incident without speculation about leaked data; for the media, a single spokesperson with an approved statement. Every message is approved by legal before sending.

The 72-hour GDPR notification applies when there is a risk to data subjects’ rights and freedoms; the AEPD offers an online form. In Spain, INCIBE-CERT and specialized police cybercrime units accept the case and preserve evidence under a legal chain of custody. Reporting does not prevent insurance from covering the loss; many policies require it.

7. Steps 4-7: Recovery, Forensics, Learning and the Pay Decision

Recovery is done in order: restore critical systems first from verified immutable backups, then apply patches, and only then reconnect with enhanced monitoring. Forensic analysis identifies the entry point so it can be closed. After recovery, update the plan and train the team with lessons learned.

On paying the ransom: the professional recommendation is not to pay — it does not guarantee decryption and funds crime — but it is a business decision that management must make with legal and forensic advice. Document the decision. CERTs worldwide recommend not negotiating without expert accompaniment.

If the decision to pay is made anyway, it should be negotiated by professionals experienced in extortion cases, never by the employee who received the ransom note. Negotiators can often reduce the amount and obtain a decryptor, but re-encryption cases still exist. The alternative is the same in all cases: verify the backups, restore in order and close the entry point first.

The Incident Commander: One Decision-Maker, One Channel

Every successful ransomware incident response has one person in charge. The incident commander (IC) is the single authority that coordinates teams, approves actions and communicates with management. Without a defined IC, teams improvise, information is duplicated and decisions are delayed.

The IC must be able to say no: to the administrator who wants to reboot the encrypted server, the vendor proposing a restore from a suspicious backup, and the manager announcing the incident before it is confirmed. The role works with a small escalation team — one technical lead, one legal lead, one communications lead — and every decision is recorded with its time and rationale. In organizations without an internal IC, the response provider should assign one on the first call.

Evidence and Chain of Custody: The Investigation That Follows

Most ransomware incidents end up in a criminal investigation or an insurance claim, and both require evidence that stands up in court. Chain of custody means documenting who handled each piece of evidence, when and for what purpose — from the first log copy to the forensic report.

Do not power off systems if you can isolate them instead; memory evidence is lost at shutdown.
Make bit-by-bit copies of disks before any restoration, not just copies of files.
Preserve EDR, SIEM, firewall and email logs from before the incident, on external media.
Have a certified forensic provider take over collection as soon as possible.
Ask the insurer what evidence format their cyber policy requires.

Anything an employee modifies after the incident — a password, a config file, a reboot — can destroy evidence and reduce the insurance payout. That is why the containment phase of a ransomware incident response balances two objectives: stopping the encryption and preserving the investigation.

Restore Order: What to Recover First and How to Verify

Restoration is a sequence, not a race. Start with the systems that keep the business alive: identity services, ERP or CRM, email and critical databases, always from the last verified immutable backup. Restore to a quarantine environment first, scan the restored data for persistence artifacts — scheduled tasks, services, login scripts — and only then reconnect it behind enhanced monitoring.

A common mistake is restoring everything at once: if a machine was the entry point, it becomes the entry point again. The “go live” criterion is not a working system; it is one that is patched, scanned, monitored and verified against the forensic findings.

8. Conclusion

Ransomware incident response cannot be improvised in the moment: it is a trained, tested procedure backed by experts. Early containment, forensic assessment, controlled communication and restoration from immutable backups are the four pillars that separate a managed crisis from a business catastrophe.

At Jaymon Security we help companies prepare for and respond to ransomware incidents: response plans, drills, digital forensics and assisted recovery. Learn more at jaymonsecurity.com or at the No More Ransom initiative by Europol and partners.

Need help with Ransomware incident response?

At Jaymon Security, we help organizations protect their systems. From security audits to SIEM/SOC implementation, our expert team designs custom solutions.