What's Truly Scary This Halloween: The First 72 Hours of a Ransomware Attack

It's 7:40 a.m. on a Monday. The first employee to arrive turns on their computer and, instead of the desktop, sees a note: your files have been encrypted. The accounting server doesn't respond, the ERP shows errors, and someone in the team chat asks whether anyone else "has a weird screen."

In February we wrote about how to prevent ransomware. This time we cover what almost nobody plans for: what to do when prevention has failed. In an attack, the decisions made in the first few hours determine whether the company recovers in days or in months.

Hour 0 to 1: contain without destroying evidence

The instinct is to shut everything down. Don't. Powering machines off wipes information from memory that helps you understand how the attacker got in and, in some cases, recover encryption keys.

The right move is to isolate:

• Disconnect affected machines from the network: unplug the cable and turn off Wi-Fi, but leave the machine on
• Block remote access: VPN, remote desktop and any remote support tools
• Suspend suspicious accounts, starting with administrator accounts
• Don't delete or reinstall anything yet, even if it looks like the fastest way back to work

Hours 1 to 24: organize the response

A ransomware attack is not just a technical problem. It is a crisis that touches operations, finance, customers and legal obligations. That's why the first meeting should include management, the IT lead, someone from legal and whoever handles communications.

In those first hours you need to answer five questions:

1. What is affected? Take a quick inventory of compromised servers, computers and cloud services.
2. Are the backups intact? Many attackers look for and encrypt backups before launching the attack. Verify them before relying on them.
3. Was data stolen? Today almost every attack is double extortion: besides encrypting, attackers copy the information and threaten to publish it.
4. Which ransomware variant is it? Identifying it tells you whether a public decryptor exists and how that group usually behaves.
5. Who needs to be notified? In Colombia, if personal data was compromised, Law 1581 requires reporting the incident to the Superintendence of Industry and Commerce (SIC). Filing a report with the National Police's CAI Virtual and contacting colCERT is also recommended.

To pay or not to pay the ransom?

It's the question everyone asks, and the short answer is: not as a first option, and never without expert advice. Paying doesn't guarantee a working key, doesn't stop the stolen data from being published, and marks you as a company willing to pay, which increases the odds of a second attack.

The best way to never face that question is to have backups the attacker cannot touch.

Days 2 and 3: recover carefully

Restoring in a rush is the most common mistake. If the door the attacker used is still open, restored systems get reinfected within hours.

• Find and close the entry point: a leaked password, a phishing email, an unpatched server
• Change every credential, especially administrator, service and cloud accounts
• Restore by priority: first whatever stops operations (billing, ERP, email), then the rest
• Restore into a clean, verified environment, not onto the compromised machines
• Communicate openly with customers and suppliers about what happened and what you're doing

What sets fast recoverers apart

Companies that come out of an attack well weren't lucky: they had a written plan before they needed it. That plan covers who decides, who gets called, where the backups are and in what order systems are restored.

And most importantly, they practiced it. A two-hour tabletop exercise, where the team walks through a fictional attack step by step, reveals gaps no document shows. For example, that nobody knows the password to the backup console, or that the only person who does is on vacation.

Your homework this Halloween

You don't have to wait for an attack to know whether your company is ready. Ask yourself these three questions today:

• When did we last restore a full backup and confirm it works?
• Do we have at least one offline or immutable backup that an attacker can't delete?
• Does the team know what to do, and who to call, if the ransom note shows up tomorrow?

If any answer gave you chills, Datandina can help you build your incident response plan, review your backups and train your team with a tabletop exercise. Get in touch: preparing is far cheaper than recovering.