The first hour of a ransomware incident

A locked screen, renamed files, a ransom note. What happens in the following hour decides the rest: how many systems get hit, whether the evidence survives, whether the backups hold and whether you meet your legal obligations. Here is the order of operations, taken from the Canadian Centre for Cyber Security's ransomware playbook (ITSM.00.099) and CISA's #StopRansomware checklist, adapted to the Québec context.

First: assume the attacker is still there

The Cyber Centre puts it plainly: once you know of the infiltration, assume the threat actor is still in your network and watching your communications. CISA adds that attackers monitor the organization's activity to learn whether they have been detected. Two immediate consequences: do not discuss the incident in company email or chat, and isolate in a coordinated way rather than one system at a time.

Minutes 0 to 10: isolate

• Determine which systems and devices are affected.
• Disconnect them from the internet and the internal network: cable unplugged, Wi-Fi off. If several systems or subnets appear affected, CISA recommends taking the network offline at the switch level, because unplugging each machine is not realistic.
• Do not power machines off if you can unplug them: powering off wipes volatile memory and evidence with it. Power off only if disconnecting is impossible.
• For cloud resources, take a snapshot of the volumes for later analysis.
• Prioritize isolating the systems essential to operations.

Minutes 10 to 20: alert out of band

Assemble the response team from your plan (if there is no plan: the person responsible for IT, management and your security provider). Use phones or personal messaging, never company tools. Name one person who writes everything down: time, systems, actions, decisions. That log will serve the investigation, the insurer and the Commission d'accès à l'information.

Minutes 20 to 30: cut the remaining access

The Cyber Centre recommends disabling VPNs, remote-access servers, single sign-on and cloud or publicly accessible assets as additional containment measures. Reset the passwords of administrator and user accounts, but not the ones you will need to restore backups. Create temporary administrator accounts for the recovery, so you can tell whether the attacker is still using the original ones.

Minutes 30 to 45: preserve and report

• Preserve the logs (firewall, servers, antivirus or EDR, Microsoft 365 or Google Workspace): the incident is often the last act of an older intrusion, and the logs show where the attacker came in.
• Check your offline backups before anything else: are they intact, from what date, and did the attacker reach them?
• Report the attack to your local police: it is a crime, and an investigation may follow. Report it as well to the Canadian Anti-Fraud Centre and to the Cyber Centre (My Cyber Portal). For a known ransomware family, police may sometimes provide a decryption key.
• Notify your insurer if you carry cyber insurance; policies often impose deadlines and approved providers.
• Write down, before anything else changes, what you know for certain and what you only suspect. The Cyber Centre's checklist asks you to keep evidence and document the steps you take; that record is what the investigation, the insurer and the Commission will rely on.

Minutes 45 to 60: Law 25

If personal information (customers, employees, patients, citizens) is affected, encrypted or exfiltrated, you are in the confidentiality-incident regime. The Commission d'accès à l'information summarizes your duties: react quickly to limit the risks, assess whether the incident presents a risk of serious injury and, if so, notify the Commission and the persons concerned as soon as possible, with the content set by the Regulation respecting confidentiality incidents. In every case the incident goes into the register, even without a serious risk. That assessment begins within the first hour; the notice follows as soon as the facts are established.

What not to do

• Pay or negotiate before talking to the police and a professional. The Cyber Centre notes that the decision belongs to the organization, but that paying carries risks: no guarantee of recovery, the possibility that the threat actor uses a wiper, and stolen data stays stolen.
• Restore backups onto the infected network. Restoration happens in a clean, isolated environment, after scanning the backups.
• Wipe or reinstall before the evidence is preserved.
• Announce publicly before you know what happened; prepare a statement, but take the time to establish the facts.

After the first hour

Next comes eradication (securely wipe and reinstall the affected systems, update firmware and patches), recovery from verified backups, fixing the entry point, then root-cause analysis. A ransomware incident is almost always the symptom of an earlier weakness: remote access without strong authentication, a missing patch, an account compromised by phishing.

That is exactly what our monitoring and incident response is meant to see before the screen locks. And if it already has: under attack now?