Ransomware: what typically happens next

• Isolate affected systems: disconnect infected devices from the network to prevent lateral spread.
• Preserve evidence: avoid wiping systems; forensics relies on logs, memory, and disk artifacts.
• Disable remote access: shut down VPNs, RDP, and compromised credentials until reviewed.
• Notify internal leadership: legal, finance, operations, and executive teams need to be aligned immediately.

Powering systems off without guidance can destroy evidence. Containment should be deliberate, not reactive.

The first mistake after ransomware is often rushing to “fix it” before understanding it.

• Contact legal counsel: privacy counsel helps preserve privilege and manage notification obligations.
• Notify your insurer: cyber and professional liability policies often require prompt notice.
• Activate incident response: carriers may provide approved forensic, negotiation, and restoration vendors.
• Document decisions: timelines and rationale matter later—especially in litigation or regulatory review.

Using non-approved vendors or delaying notice can jeopardize coverage. Policy conditions matter early.

In ransomware, the response team is as important as the response itself.

• Initial access vector: phishing, stolen credentials, unpatched software, or third-party access.
• Scope of compromise: which systems, backups, and data sets were accessed or encrypted.
• Data exfiltration: whether sensitive data was copied before encryption (double extortion).
• Dwell time: how long attackers were present before detection.

These findings affect breach notification laws, contractual liability, regulatory exposure, and ransom strategy.

Until forensics is complete, every assumption is provisional.

• Do not pay immediately: early payment rarely improves outcomes and may violate sanctions.
• Assess legality: some threat actors are tied to sanctioned entities—payment may be illegal.
• Negotiate strategically: professional negotiators often reduce demands or extend timelines.
• Validate decryptors: proof-of-life tests help confirm attackers can actually restore data.

Paying a ransom does not guarantee full restoration, data deletion, or immunity from future attacks.

Ransom payment is a business decision—not a technical fix.

• Clean rebuilds: compromised systems are often rebuilt from scratch, not “cleaned.”
• Backup validation: backups must be scanned before reintroduction to avoid reinfection.
• Prioritization: revenue-generating and safety-critical systems come first.
• Temporary workarounds: manual processes may be required during partial restoration.

The fastest way back is rarely the safest way back.

• Client claims: customers may allege negligence, failure to safeguard data, or breach of contract.
• Third-party vendors: disputes arise over who caused or should have prevented the breach.
• Regulatory scrutiny: investigations may question policies, controls, and representations.
• E&O response: professional liability can respond to defense costs and covered allegations.

Cyber insurance covers the incident response; professional liability addresses claims about how services were performed.

Cyber handles the breach. E&O handles the blame.

• Communication strategy: what to tell employees, customers, vendors, and regulators—and when.
• Operational tolerance: how long the business can function at reduced capacity.
• Financial exposure: downtime costs, ransom scenarios, restoration expense, and uninsured gaps.
• Future controls: patching, MFA, backups, and monitoring required before full relaunch.

The first week sets the narrative—for courts, regulators, and customers alike.

Should we pay the ransom?
Sometimes organizations do, often after legal review and negotiation. It is never risk-free and should be evaluated against restoration options, legality, and long-term impact.

How long does recovery take?
Days to weeks for partial restoration; weeks to months for full recovery, depending on system complexity and data loss.

Will insurance cover everything?
No. Coverage depends on policy language, limits, exclusions, and compliance with notice and vendor requirements.