Ransomware: What to Do in the First 72 Hours

No organization plans to be hit by ransomware, but the ones that recover well have one thing in common: they decided what they would do before it happened. For healthcare providers and nonprofits, where systems support patient care, member services and donor trust, the first 72 hours shape everything that follows.

This is a practical outline of what those hours should look like, and what you can put in place now so they go as well as possible.

Hour 0–4: Contain, don’t clean

The instinct is to start wiping and restoring machines. Resist it. The priority is to stop the spread and preserve what you’ll need to understand the attack.

• Disconnect affected devices from the network, but don’t power them off. Memory and logs can be critical evidence.
• Disable compromised accounts and force password resets for privileged accounts.
• Take backups offline immediately if they aren’t already isolated.
• Start an incident log: who noticed what, when, and every action taken.

Hour 1–12: Activate your response team

Bring together the people who need to make decisions quickly: leadership, IT and your security partner, legal counsel, and your cyber insurance carrier. Many policies require prompt notification and may direct you to specific incident response firms, so call early. Use out-of-band communication, such as phones or a separate messaging tool, in case email and chat are compromised.

Hour 4–24: Understand the scope

With containment in place, work out what happened:

• Which systems and data are affected, and which are confirmed clean?
• How did the attacker get in, and are they still present?
• Was data taken as well as encrypted? Many attacks now involve both.
• Are your backups intact, uninfected and recent enough to restore from?

The answers drive every decision that follows, including legal obligations, restoration order and how you communicate.

Hour 12–48: Keep operations running

This is where preparation pays off. Switch to downtime procedures for critical functions, such as paper processes, read-only access or alternate systems, so you keep serving patients, members and the community. Prioritize restoration by business impact, not by which system is easiest to fix.

Hour 24–72: Communicate and meet your obligations

Clear, honest communication protects trust. Prepare internal updates for staff, and work with counsel on what to tell patients, members, donors, partners and regulators, and when. Healthcare organizations need to assess their obligations under HIPAA’s breach notification rule, and state data breach laws may apply too. Report the attack to law enforcement; in the United States, the FBI and CISA both accept ransomware reports.

Decisions about ransom demands should involve leadership, counsel, your insurer and your incident response team. Paying doesn’t guarantee data recovery or deletion, and in some cases it can carry legal risk.

Restore carefully

Rebuild from known-good backups onto clean systems, patch the weakness that let the attacker in, and monitor closely for signs they’re trying to return. Restoring too fast, before the root cause is fixed, is one of the most common ways organizations get hit twice.

What to put in place now

• A written incident response plan with named roles, contact lists and decision authority, stored somewhere you can reach if your systems are down.
• Isolated, tested backups. Test restores regularly; a backup you’ve never restored is a hope, not a plan.
• Multi-factor authentication everywhere, especially remote access, email and administrator accounts.
• Endpoint detection and 24/7 monitoring so attacks are spotted early, often before encryption starts.
• A tabletop exercise at least once a year to walk leadership through a realistic scenario.
• Downtime procedures for your most critical services.

The bottom line

You can’t control whether you’re targeted. You can control how ready you are. A clear plan, tested backups and a team that has practiced together turn a crisis into a recoverable incident.

Want to test your readiness? Talk with our team about incident response planning, backup testing and tabletop exercises.