A user calls at 7:40 on a Tuesday. Files are opening as gibberish, and a strange text file sits on every desktop. By the time the helpdesk ticket is written, two file servers may already be encrypted. The decisions made in the next 60 minutes decide whether this becomes a bad week or a lost quarter. This checklist assumes you have incomplete information, tired people, and no time to research best practice from scratch.

Minute 0–5: Take Control

Ransomware incidents fail at the coordination layer before they fail at the technical layer. Two people isolating the same server while a third restores a backup is how small incidents become large ones.

• Name one incident commander. Someone senior enough to say "stop" and be obeyed. They do not need to be the most technical person in the room.
• Start a timeline. A shared document with timestamps in a single timezone, recording what was seen and what was done. This becomes the backbone of every later report.
• Confirm the shape of the problem. One laptop? A mapped drive? Multiple sites? Ask the reporting user what they clicked, opened, or saw, but do not blame them — you need the facts, not a culprit.
• Do not pay, delete, reboot, or reimage anything yet. Those actions are irreversible in ways that matter.
• Raise the call tree. IT lead, security or incident response retainer, legal counsel, cyber insurer, communications lead. Have the numbers on paper, not only in the mailbox you may lose access to.

Minute 5–15: Contain Without Destroying the Evidence

The instinct to yank power cords is understandable and wrong. Memory holds encryption keys, running processes, and live network connections — all gone the moment a machine loses power. Reboots also trigger cleanup routines that delete artifacts.

Preferred order of operations on a suspect host:

1. Unplug the network cable at the NIC, or better, shut the switch port. Disabling the port keeps the machine powered and reachable for later memory capture.
2. Turn off Wi-Fi and disable any secondary connections, including mobile broadband.
3. If several hosts share a VLAN, isolate the VLAN rather than chasing individual machines.
4. Block outbound access to known command-and-control addresses at the firewall and proxy, if you have them.
5. Disable compromised service accounts, VPN accounts, and any new administrator accounts you find — after noting them down.

Where a domain controller may be involved, treat it as a full domain compromise and coordinate rather than improvising. Snapshot virtual machines before making changes so you keep a copy of the state you found. And keep helpdesk away from "cleanup" tools: quarantining files and running removal scripts destroys exactly what investigators need.

Minute 15–30: Preserve What Will Be Needed Later

Evidence collection in the first hour is mostly about not losing things that expire.

• Ransom notes: note the exact filename and location, copy the file, and record a hash. Do not edit it.
• Live state: capture a memory image if you have the tooling and a trained person. If not, photograph screens showing process lists, network connections, and open sessions.
• Detection data: export EDR and antivirus console alerts now. Retention windows can be days, not months.
• Authentication logs: VPN, RDP, and directory service logins for privileged accounts, ideally 90 days back.
• Persistence: scheduled tasks, new services, startup keys, and any new local administrators.
• Backup status: are the repositories reachable from the compromised network? Have they been encrypted or deleted?

Record who handled each item and when. A simple chain-of-custody line in your timeline is enough for most internal and insurance purposes, and it costs nothing.

Minute 30–45: Say the Right Things to the Right People

Assume the attacker can read your email and chat. Corporate mail is often the first thing they monitor. Move coordination to a channel outside your domain — a phone bridge, a separate messaging tenant, or calls — and keep the invite list tight.

• Executives: a short factual briefing. What is confirmed, what is unknown, what you are doing next, and when you will update them again.
• Staff: tell people not to attempt fixes, not to use personal devices for work, and not to discuss details in public channels.
• Legal counsel and insurer: many policies require prompt notice and the use of approved vendors. Late notification can affect cover.
• Law enforcement: your national cybercrime unit can advise and may have decryption or intelligence resources.

Notification duties, payment restrictions, and regulatory deadlines vary by country and sector. Those questions belong with counsel, not with your infrastructure team. Do not talk to the attacker until legal and incident response are engaged, and do not post details in forums where a criminal group can watch your response.

Minute 45–60: Choose the Recovery Path

Restoring too early is the most expensive mistake in ransomware response. If the entry point and persistence are still unknown, a restored server can be re-encrypted before the day ends.

• Verify backups before trusting them. Confirm they are offline or immutable, then test-restore a single file to an isolated segment.
• Rebuild, don't clean. Any host that was encrypted or touched gets reimaged from known-good media.
• Rotate credentials starting at the top. Domain and privileged accounts first, then service accounts, then everything else. Assume any password that existed on a compromised system is known.
• Prioritise by business function with the people who own those functions, not alphabetically by server name.
• Watch for a second wave. Attackers often return once recovery begins.

After the First Hour

Keep the timeline running. For the next 24 hours, work on scoping the blast radius, forming a root-cause hypothesis, and deciding whether external forensic support is needed. Then do the work that would have made this hour easier: a printed contact sheet, an out-of-band communication channel, immutable backups tested on a schedule, endpoint detection on every machine, a map of critical assets, and a tabletop exercise that forces people to practise the decisions above.

No one executes this perfectly under pressure. If you do only three things in the first ten minutes, make them these: put one person in charge, cut the network rather than the power, and write down what you see.

Photo: StartupStockPhotos / Pixabay