The ransomware first-hour playbook.

The first hour of a ransomware incident is the most important hour. Good decisions here make the rest of the response survivable. Bad decisions — well-meaning ones like rebooting servers or deleting ransom notes — often destroy the evidence and the leverage you need to recover.

What actually matters in the first 60 minutes

Your job is not to fix anything in the first hour. Your job is to contain the damage, preserve what's still clean, and get the right people on the phone. Rushing to 'fix' without thinking is how businesses turn a recoverable event into an unrecoverable one.

Two responses, two outcomes

The playbook

• Do not power off affected machines — pull them from the network instead (unplug Ethernet, disable Wi-Fi).
• Do not delete the ransom note or any files. They are evidence.
• Call your MSP's emergency line and your cyber insurance carrier. In that order.
• Loop in your breach counsel. Regulators have deadlines you won't want to miss.
• Stop using the affected environment. Switch to personal devices for email and phones for calls until cleared.
• Document everything — what time did you notice, what did you do, what do you see.

Things you might be tempted to do — don't

• Don't reboot or reimage systems until forensics has a clean image.
• Don't pay the ransom without talking to counsel and your insurer first.
• Don't try to 'negotiate' yourself — use a professional negotiator if paying is even on the table.
• Don't post about it online or tell staff to delete suspicious emails — preserve everything.