Ransomware response: what to do in the first 48 hours, whom to call and when to report

If you are reading this during a ransomware attack, do three things first: disconnect the affected computers from the network without wiping them, keep the ransom note, and call your IT partner and, if you have cyber insurance, its incident line. Then come back to this page.

For everyone else, this is the rehearsal. Ransomware is far rarer than phishing, hitting 1% of UK businesses in the government's latest survey (source: UK government, April 2026), but when it hits, the first two days decide how much extra damage is done. They bring decisions that are hard to make for the first time under pressure: what to switch off, whom to call, whether to pay, which reporting clock is running.

1. 1
   IsolateUnplug network cables and switch off Wi-Fi on affected devices, laptops at home included. If the attack spreads, the IT partner can cut the internet connection.
2. 2
   Do not wipe or restore yetReinstalling destroys the traces of how the attacker got in. CISA advises a system imageSystem imageAn exact copy of a disk, and ideally the memory, so investigators can study the attack without changing the original. and memory capture of a sample of affected devices (source: CISA, September 2023).
3. 3
   Protect the backupsDisconnect backup storage and pause backup jobs so encrypted files cannot overwrite good copies.
4. 4
   Keep the evidenceSave the ransom note, emails and any payment addresses or chat links, and have logs from servers, email and firewall secured before they are overwritten.
5. 5
   Start a decision log and switch channelRecord what was found and when, and which decisions were taken, by whom and why (source: UK NCSC, October 2026). Assume the attacker reads email and chat; CISA advises out-of-band communication such as phone calls (source: CISA, September 2023).

Give the incident a small team with named deputies, including a director who decides on money; the toolkit below lists the roles. The UK NCSC advises clear authority for decisions on containment, recovery and communication (source: UK NCSC, October 2026).

UK law enforcement does not encourage, endorse or condone paying: there is no guarantee you get your data back, your computers stay infected, you fund criminals and you are more likely to be targeted again (source: UK NCSC, September 2021). Paying can also break sanctions law: the US Treasury's Office of Foreign Assets Control (OFAC) warns that paying a sanctioned person can lead to civil penalties even if you did not know who you paid (source: US Treasury OFAC, September 2021).

The European Commission proposed in November 2025 to require notification only for high-risk breaches, within 96 hours (source: European Commission, November 2025); as of November 2026 that proposal was still before the European Parliament (source: European Parliament, November 2026). Elsewhere the rules differ: every US state has its own breach notification law (source: FTC, August 2023), and in Australia, organisations covered by the Privacy Act notify affected people and the OAIC when serious harm is likely (source: OAIC, March 2023).

Sector rules and listed companies

In the EU, the NIS2 Directive covers, as a rule, medium-sized and large organisations in 18 critical sectors (source: European Commission, July 2026). Entities in scope send an early warning to the national CSIRTCSIRTComputer security incident response team: a team, often national, that receives incident reports and offers advice. or competent authority within 24 hours of becoming aware of a significant incident, a notification within 72 hours and a final report a month later (source: European Commission, June 2023). National laws set the details. US-listed companies disclose a material cybersecurity incident to the SEC, generally within four business days of deciding that it is material (source: SEC, July 2023).

The UK NCSC advises controlled, coordinated channels, with alternatives if company channels cannot be trusted. Update staff even when information is incomplete, tell customers when services return and how to reconnect, and expect suppliers to ask for assurance that your compromise will not spread to them (source: UK NCSC, October 2026).

• One spokesperson: all outside questions go to one person.
• A clean channel: phone, text or an app agreed in advance, until email is known to be safe.
• A warning about fake messages: tell customers that requests for payment or data in your name may be fake, and how to check.
• Rest for the people doing the work: the UK NCSC advises enforced downtime against fatigue and burnout (source: UK NCSC, October 2026).

Lessons learned

Recovery often takes longer than leaders expect (source: UK NCSC, October 2026). Once systems run, hold a structured lessons-learned review: what happened, which assumptions did not hold, where plans got in the way (source: UK NCSC, October 2026). Give each improvement an owner and a date, and check how the attacker got in against the measures in cybersecurity basics.