Essential Guide for the First Hour After a Ransomware Attack: How to Limit Damage

That first hour after a ransomware attack decides exactly how much you lose and how much you will be able to find out later. Not because anything magical can be fixed in 60 minutes. In 60 minutes, evidence can be destroyed, encryption can spread, and critical legal deadlines can be easily missed.

A warning from incident response practice

Security specialists constantly observe much more massive damage strictly produced by blind panic in the initial phase than by that first attack itself.

What does the cyber incident's ground zero look like?

Most of the time, absolutely no one from the IT department proactively "detects" the attack. Someone completely unrelated to the technical division discovers it.

Classic corporate discovery

It's often the accountant, on a Monday morning at 7:40, when invoices no longer open. Completely unknown extensions and a small text file with firm payment instructions appear on the screen. At this moment, you don't know three vital things: how long the attacker has been in the network, what systems they reached, and if they still have active access.

The assumed ignorance you must start from

Everything you must do in the first hour after a ransomware attack starts exactly from this assumed ignorance. You must never start from the false assumption that "only one computer was affected".

What to do in the first 15 minutes: correct network isolation

The main goal is to stop the spread within the network without destroying precious information at all.

Immediate technical measures for data protection

• Disconnect, don't shut down
  Pull the physical cable and completely turn off the Wi-Fi connection. Do not turn them off. A computer that is on, but totally isolated, keeps traces in its memory that a specialist can easily recover. An off one loses them irrecoverably.
• Isolate on a large scale
  Isolate much more than just the systems with a ransom note. The station from which it originally started is very likely in another room and looks completely normal.
• Stop external connections
  Urgently stop any remote connections, such as VPN and remote access. Keep them off until it is exactly clear through which breach they entered.
• Secure your backups
  Completely disconnect the backup immediately, if it wasn't already isolated. These still unencrypted copies are absolutely the most valuable thing the organization possesses.

A relevant case study from Romania

The ANP case from July 29, 2026, shows the correct reflex perfectly. The IT team immediately isolated the equipment, contacted DNSC, and preventively stopped several services. The preventive shutdown of totally uncompromised services is always the correct decision when you don't know the real extent of that attack.

What not to do, no matter how tempting the impulse is

This short list comes exclusively from real mistakes, constantly repeated by companies.

Actions that destroy the investigation in the first hour after a ransomware attack

• Do not brutally shut down servers "so it doesn't spread". Physical network isolation achieves perfectly the same effect.
• Do not delete the "virus" and do not run cleaning programs. Without these vital proofs, absolutely no one will be able to tell you how that attacker truly got in.
• Do not immediately restore data over already affected systems. This restoration is done only on completely clean systems.
• Do not contact the attackers at all and do not pay anything on impulse. The huge payment never guarantees complete decryption or data deletion.
• Never communicate from systems within the affected internal network. The attacker can read your crisis correspondence unhindered.

Evidence preservation: what to keep and how to proceed

You are not asked for a complicated forensic analysis at all. It is strictly vital not to make it completely impossible for specialists.

Essential steps for preserving evidence

• Mandatorily photograph the screens with the note and error messages.
• Write down the clear timeline on a simple piece of paper: who noticed, at what time, and what actions were taken.
• Do not touch the logs on the firewall, servers, and email system at all.
• Keep that ransom note and absolutely any newly appeared file.
• Do not panic and reset all passwords in the first minutes of the crisis.

Who do you notify legally and when?

All legal deadlines flow directly from the moment you officially become aware of a cyber incident.

Notification guide and critical deadlines

What you can do this very week for safety

Urgently write down on a simple page the crisis contact list. You must clearly include the IT provider, a legal consultant, the insurer, DNSC, and ANSPDCP. Print it immediately! If the network is encrypted, the contact file will surely be inaccessible as well.

A simple and completely free tool for teams

Check if you fall under OUG no. 155/2024 (NIS2). Also confirm that the backup can be quickly disconnected in just a few minutes. In conclusion, success in the first hour after a ransomware attack is not won with technology at all, but only with a lot of discipline and calm. If you cannot clearly say today who calls DNSC, that is exactly the first major thing to solve.

Call experts anytime for a rapid response

We can always bring a simple solution to keep the whole system in a safe place. A clear plan for the first hour after a ransomware attack saves businesses. Therefore, contact our experts by visiting the contact form on the site and receive the appropriate IT support. We always help your companies by conducting a complete IT audit for companies and we find vulnerabilities. In addition, we bring cybersecurity solutions for your business meant to fully support office work.