The First 24 Hours After a Ransomware Attack — When You Have No Security Team

Most ransomware guides assume you have a security team, a retainer, and a war room. If you run a small team, you have none of that — just a laptop, a backup, and a rising sense of panic.

Here is what actually matters in the first 24 hours, in order.

Hour 0–1: Contain before you think

• Disconnect, don't shut down. Pull network cables / disable Wi-Fi on affected machines. Powering off can destroy volatile forensic evidence.
• Isolate shared drives. Ransomware spreads through mapped drives and SMB shares. Every minute it stays connected, more files encrypt.
• Disable sync and remote access. Pause OneDrive/Google Drive sync, block VPN logins for everyone.

Hour 1–3: Establish facts, not rumors

• What is encrypted? Screenshot it. File extensions, ransom note filenames (README.locked, HOW_TO_DECRYPT.txt) identify the strain.
• Can you reach your backups? Check whether backup storage is offline. Online backups get encrypted too — this is the #1 small-team failure.
• Reset credentials from a clean device: email admin, VPN, domain admin, cloud consoles. Attackers persist via stolen passwords, not just encryption.

Hour 3–8: Decide the path

You have three options, and you should know which one you're on before you talk to anyone outside the team:

1. Restore from backups — cheapest path if backups are intact.
2. Negotiate — the path criminals want you on; rarely ends well and sometimes lands you on sanctions lists.
3. Rebuild from scratch — slow but final: new machines, restore data only from clean sources.

Hour 8–24: Communicate before you're forced to

• Notify employees in writing: no opening emails about the incident from outside addresses (attackers phish during incidents).
• Prepare the customer/legal statement now, not when a journalist calls.
• Check your notification obligations — GDPR, state breach laws, cyber-insurance policy terms (insurers routinely deny claims from unreported incidents).

The part nobody tells you

Almost every small-team incident goes wrong at one of two moments: the encryption spreads to backups (because they were online), or credentials were reset after the attacker had already emailed themselves the admin password.

Both failures are preventable the week before an incident — not during one.

Before the bad day, spend one afternoon

• Move backups offline (rotating disk or cold storage) and test a restore.
• Write down who calls whom in the first hour. No spreadsheet? A photo of a whiteboard is fine.
• Run one tabletop exercise with your team. Sixty minutes. It will feel awkward and it will save you a week.

If you want the fill-in-the-blank version of all of the above — severity matrix, five tabletop scenarios (ransomware, BEC, insider threat, lost laptop, data exfil), first-24-hours comms templates, and containment checklists for Linux/macOS/Windows — I built the Ops Starter Kit for exactly this situation:

→ https://hive80.gumroad.com/l/ops-starter-kit

Stay safe. Prepare on a calm day, not a bad one.