A ransomware attack doesn't begin when the ransom note appears on the screen. In most cases, the attacker has already gone through internal reconnaissance, lateral movement, credential collection, and often data exfiltration. Therefore, responding effectively to a ransomware attack requires more than simply getting systems back online. The company needs to understand how the attacker gained access, what data was accessed, what credentials were exposed, and what needs to be fixed before reconnecting the environment.

This difference between confidence and actual ability becomes clear in Veeam's Data Trust and Resilience 2026 reportAlthough 90% of security leaders say they are confident in their own recovery after a cyber incident, less than a third of ransomware victims managed to restore all their data. This statistic shouldn't be alarming, but it points to a practical conclusion: plans that aren't tested under pressure tend to fail when the company needs them most.

In this article, we show what to do, in what order, and What is the logic behind each step?, from detection to operational resumption. 

Why the first few hours are the most critical.

When ransomware is detected, encryption may already be underway. The priority shifts from "resolve everything now" to containing the spread, preserving evidence, and making decisions based on facts. A hasty response, without analysis, usually amplifies the damage: systems are shut down indiscriminately, logs are lost, backups are contaminated, and compromised credentials remain valid.

The response window is smaller. According to the Global Incident Response Report 2026 from Unit 42, Palo Alto NetworksThe fastest quartile of attacks achieved data exfiltration in about 72 minutes in 2025, compared to almost five hours the previous year. In practice, this means that containment needs to begin before the team has all the answers.

Another important point is the time. Sophos Active Adversary Report 2026 This shows that incidents investigated by their teams continue to be strongly associated with identity breaches and actions outside of business hours. This context reinforces the need to have people, contacts, and responsibilities defined before a crisis.

Step 1: Detect, confirm, and do not delete evidence.

The first instinct of many teams when detecting anomalous behavior is to try to remove the problem immediately. This reflex, understandable under pressure, can destroy forensic evidence essential to understanding the entry vector, the extent of the compromise, and the identity of the attacking group.

Before any remediation action, the responsible team needs to confirm that it is a ransomware incident and not a technical failure or an ongoing security test. The most common signs include files with unknown extensions, ransom notes on the screen or in directories, abrupt system slowdowns, inability to access shared files or drives, and simultaneous alerts from multiple endpoints. Once the incident is confirmed, the immediate priority is to preserve system logs, access records, network traffic captures, and any artifact that can be analyzed later by the forensic team or authorities.

This process should be guided by the official guide.  #StopRansomware from CISA, published in conjunction with the FBI and the NSA, which describes in detail the technical procedures for detection, analysis, and collection of evidence recommended for organizations of any size.

Step 2: Isolate without turning off

Once an incident is confirmed, the immediate goal is to contain its spread without losing evidence. Isolation does not mean shutdown. Abruptly shutting down systems can corrupt data that has not yet been encrypted, destroy processes in memory that could be analyzed, and compromise later recovery.

Proper isolation involves disconnecting compromised endpoints from the network without shutting them down, revoking active remote access and VPN sessions, segmenting the affected environment to prevent ransomware from spreading laterally to critical, still-intact systems, and disabling any compromised service accounts and administrative credentials. 

The concern with identity is not an exaggeration. Semperis' analysis for 2026 on ransomware defense. It highlights that successful attacks often involve compromising Active Directory or other access control mechanisms. Therefore, until the investigation proves otherwise, critical credentials should be treated as potentially exposed.

To understand how backup strategies directly relate to recovery capabilities in this type of incident, read: How often should I back up my company's data?

Step 3: Activate the right people immediately.

A ransomware attack is not a purely technical incident. It involves legal decisions, regulatory obligations, communication with clients and partners, and, depending on the sector, mandatory notification to the authorities. All these fronts need to be activated in parallel, not sequentially.

The internal notification chain should include executive leadership, the legal team, the data protection officer (DPO), responsible for the obligations stipulated in the LGPD (Brazilian General Data Protection Law), the communications team, to manage the narrative with stakeholders, and the external incident response partner, if the organization has contracted this service. 

In Brazil, incidents involving the personal data of data subjects must be reported to... National Data Protection Authority (ANPD) and to the affected data subjects within the timeframe defined by the LGPD. Internationally, the The FBI recommends immediate reporting via IC3. and does not recommend paying the ransom. Since 2022, the agency has provided decryption keys to thousands of victims through partner programs, helping organizations avoid more than $800 million in payments.

Step 4: Don't pay before understanding what was agreed upon.

The question of whether or not to pay the ransom is the most frequent and the one that generates the most pressure during an active incident. The technically correct answer requires analysis before any decision is made. According to... Verizon 2025 Data Breach Investigations Report (DBIR)64% of organizations refused to pay the ransom, a percentage that has been growing year after year and reflects both improved backup capabilities and the influence of recommendations from government agencies. 

However, there are scenarios where cost-benefit analysis leads organizations to consider paying: when there are no complete backups and access to data is critical to business survival, when human lives may be at risk, such as in hospital environments, or when the cost of recovery substantially exceeds the ransom amount. In these cases, the decision should be made with specialized legal advice, with knowledge of the regulatory implications and, whenever possible, with the support of authorities who may have access to decryption keys from groups that have already been dismantled by law enforcement operations.

To understand the security flaws that create the conditions for this type of attack, also read: What are the most common security mistakes that put companies at risk of attacks?

Step 5: Initiate recovery through forensic analysis, not restore.

A recurring mistake among teams under pressure is initiating system restoration before completing forensic analysis. Restoring an environment that still contains the original compromise vector or exposed credentials means reintroducing the threat along with the recovered data. The result is a second incident, often more costly than the first.

Forensic analysis needs to identify the initial entry vector, which in most cases is phishing, compromised credentials, or exploitation of vulnerabilities in an exposed system; the extent of the lateral movement performed; which systems were accessed beyond the encrypted ones; what data was exfiltrated and to where; and whether there are backdoors or persistent access tools installed by the attacker that will survive the restore.

Only after this analysis is it possible to determine with certainty which systems can be restored, which need to be rebuilt from scratch, and what the most recent state of backups is that can still be considered intact. Ayko discusses how offsite backup and disaster recovery strategies support this restore capability in: The importance of offsite backup and disaster recovery in Data Centers.

Step 6: Recover carefully and validate before reconnecting.

Recovery should follow the criticality of the operation, not the technical ease of implementation. Identity systems, network services, authentication infrastructure, and applications that support the business need to come before administrative or support systems.

Each restored environment must undergo validation before returning to the corporate network: data integrity, absence of suspicious communication, review of privileged accounts, system updates, and active monitoring. Reconnecting without validation can turn recovery into a second incident.

This is where the difference between an existing backup and a recoverable backup becomes apparent. According to the Veeam Data Trust and Resilience Report 2026Many companies rely on data recovery, but few manage to restore everything after an attack. Therefore, periodic restore tests, immutable backups, and segregated environments should not be treated as mere technical details. They define the speed and security of the recovery.

What to do after data recovery?

Technical recovery marks the end of the immediate crisis, not the end of the work. Among organizations that have experienced attacks, the most common actions taken post-incident were: improving employee training and awareness programs, updating software policies to close vulnerabilities, implementing new backup solutions, and migrating to cloud backup or managed services.

The post-incident period is the most appropriate time to conduct a structured review of the security architecture. This includes mapping the entry vector and remediating the vulnerability or process that allowed it, reviewing privileged access policies and implementing the principle of least privilege throughout the infrastructure, implementing or reviewing network segmentation to limit the impact radius of a future incident, and ensuring that backups are immutable, regularly tested, and that at least one copy is located outside the primary environment. The logic is simple: the same incident should not be possible a second time for the same reasons.

This post-incident review also has a regulatory dimension. The LGPD (Brazilian General Data Protection Law) requires organizations to demonstrate adequate technical and organizational data protection measures. A documented incident without evidence of correction of the identified vulnerabilities exposes the organization to more severe sanctions in any future investigations. ANPD.

Frequently asked questions about responding to ransomware attacks.

Responding to a ransomware incident involves technical, legal, and strategic decisions that don't follow a single playbook. The questions below compile the most frequently asked questions that reach our experts during and after such incidents, with answers based on international best practices and the most recent data available.

Should I report the attack publicly or keep it secret?

Public disclosure depends on the nature of the data involved and the applicable regulatory obligations. In Brazil, the LGPD It stipulates that incidents involving personal data that may cause significant risk or harm to data subjects must be reported to the ANPD (National Data Protection Authority) and to the affected data subjects. 

Failure to report such information constitutes an additional infraction and may aggravate applicable sanctions. Regardless of legal obligation, proactive and controlled reporting tends to generate less reputational damage than disclosure by third parties, which frequently occurs when attacking groups publish data on leak websites. 

The decision of when and how to communicate should be made with specialized legal advice, based on the actual extent of the impairment identified in the forensic analysis.

How long does it take for a company to recover from a ransomware attack?

It depends on the extent of the compromise, the quality of the backups, the maturity of the response plan, the availability of specialized staff, and the need to rebuild systems from scratch. Companies with tested backups, immutable copies, dependency documentation, and a defined decision chain tend to resume operations with less uncertainty. Companies that discover during a crisis that their backups were not tested may take days or weeks to recover critical systems.

What is double extortion and how does it change the response to the incident?

Double extortion occurs when an attacker combines encryption with data exfiltration. Even if the company restores systems from backups, the risk of leakage remains. This changes the response because forensic analysis needs to identify what data left the environment, who may be affected, and what legal or contractual communications will be necessary.

How can you tell if the attack has been completely eliminated before reconnecting the systems?

There is no reliable confirmation without technical analysis. Signs supporting reconnection include lack of communication with suspected servers, review of accounts created during the compromise period, validation of restored systems, updating of exploited vulnerabilities, and continuous monitoring after resumption. In critical environments, it may be safer to rebuild systems from validated images than to attempt to "clean" compromised machines.

Respond faster and more reliably with someone who has 22 years of experience.

Ayko designs and implements security, backup, and disaster recovery strategies for companies that need to be prepared to respond efficiently to critical incidents. From assessing the current environment to implementing immutable backup solutions, EDR, and structured incident response plans, the work always begins with a detailed analysis of the actual exposure of your operation.

Get in touch with our experts Discover how to prepare your company to respond to a ransomware attack before it happens.