Someone opens a shared drive and the files have been renamed. A note appears on a screen demanding payment. The phones start. In that first hour, the instinct is to do something — anything — and that is exactly when firms make the mistakes that cost them most: paying reflexively, wiping the very evidence they will need, or telling customers something they later have to retract.
Ransomware remains one of the most damaging things that can happen to a UK business. UK bodies report that ransomware and malware now account for over half of cyber insurance claims by value, and that most reported ransomware victims are small and medium-sized firms. This is a calm, hour-by-hour view of what to do — and not do — in the first 48 hours. It assumes the bad day happens, because the firms that cope are the ones that assumed it too.
The two rules before you do anything
Do not pay reflexively. The National Cyber Security Centre and UK law enforcement do not encourage, endorse or condone paying a ransom. Paying does not guarantee you get your data back, it marks you as a firm that pays, and depending on who the attacker is, payment can even breach financial sanctions law. Payment is a last-resort decision for later, made with legal and specialist advice — never a reflex in hour one.
Do not destroy evidence. Isolate infected machines, but do not wipe or rebuild them yet, and do not turn everything off in a panic. You will need the logs and disk images for your insurer, for any regulator, and to understand how the attacker got in — so the same door is not left open after you recover.
Hour 0 to 1: contain, don’t panic
- Disconnect affected devices from the network — unplug the network cable or disable Wi-Fi — rather than shutting them down, which can destroy useful evidence held in memory.
- Isolate, do not yet rebuild. Stop the spread by segregating affected systems and disabling the accounts you suspect are compromised.
- Stand up your response team and start a log. Note the time, what you saw, and every action you take. That timeline is invaluable later — for the review, the insurer and any regulator.
- Call your insurer’s incident line before you touch anything major. Most cyber policies require you to notify them early and to use their approved responders; acting alone can prejudice your cover.
Hour 1 to 6: understand the scope
With the immediate spread contained, the priority shifts to understanding what you are dealing with — quietly, without tipping off staff or customers before you have facts.
- Get expert help engaged. Your insurer’s responders or an incident response firm can tell you which strain you are facing, whether data was stolen as well as encrypted, and what recovery realistically looks like.
- Establish whether personal data was accessed or exfiltrated. This determines your legal reporting duties and is the single most important scoping question in a UK context.
- Protect the backups. Confirm your backups are intact, offline or immutable, and not themselves encrypted — attackers routinely target them precisely so you cannot recover without paying.
- Preserve evidence deliberately. Take disk images of key systems before any clean-up, and keep them secured.
Hour 6 to 24: notify the right people, in the right order
The ICO 72-hour clock. If personal data has been breached and there is a likely risk to people’s rights and freedoms, you must notify the Information Commissioner’s Office as soon as possible and, where feasible, within 72 hours of becoming aware. You do not need every detail first: the ICO explicitly allows a phased notification — tell them what you know, flag that the investigation is ongoing, and follow up. If individuals face a high risk, you must also tell them without undue delay.
- Report the crime. Report to Action Fraud (the UK’s national fraud and cybercrime reporting centre), and consider notifying the NCSC. Ransomware is a crime; treat it as one.
- Brief staff with a holding line. People will talk. Give them a short, honest internal message and a single point of contact, so rumours do not become your external comms.
- Prepare — but hold — customer communications. Draft what you will say. Say nothing externally until you have facts you will not have to retract. A retracted statement does more reputational damage than a slightly slower, accurate one.
Hour 24 to 48: recover in the right sequence
Recovery is not a race to switch everything back on. Rushing it reinfects you. Sequence matters.
- Confirm the attacker is out and the entry point is closed before you restore anything. Restoring into a still-compromised network simply hands the systems back.
- Rebuild clean, then restore data. Rebuild systems from known-good images where you can, and restore data from your verified clean backups — not from a system you are unsure about.
- Bring critical services back first, in a planned order, testing as you go rather than all at once.
- Reset credentials broadly — passwords and, where possible, the keys and tokens the attacker may have captured.
- Communicate the resolution. Once you are genuinely recovered, tell customers and staff clearly what happened, what you did, and what you have changed.
Why rehearsal beats improvisation
Every decision above is easier if you made it before the incident. A written plan that names who calls the insurer, who talks to the ICO, and who owns customer comms turns a chaotic morning into a sequence of known steps. The NCSC’s consistent message is that preparation and a tested plan are what separate a contained incident from a crisis. A 30-minute tabletop exercise, run once, exposes more gaps than any policy document.
On the TrustOps Maturity Model, having a written incident response plan and rehearsing it is what moves a firm from Level 3, Managed, to Level 4, Measured — from “we have a plan” to “we have proved the plan works”. That is the difference you feel at 9am on the worst morning of the year.
A sensible next step
If you are not sure how your firm would handle the first 48 hours, the honest first move is to find out. Our free 15-minute assessment scores you out of 100 across all six security functions — including whether you have a tested plan and offline backups — and shows your top five gaps, whether or not we ever speak again. Start with the free assessment at trustops.co.uk/. Assume the bad day happens. Be ready.
Sources
National Cyber Security Centre — What you need to know about ransomware and how to respond: https://www.ncsc.gov.uk/ransomware/home
National Cyber Security Centre — Guidance for organisations considering payment in ransomware incidents (with ABI, BIBA, IUA): https://www.ncsc.gov.uk/guidance/organisations-considering-payment-in-ransomware-incidents
Information Commissioner’s Office — Personal data breaches: a guide (72-hour rule and phased notification): https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/
Association of British Insurers — Nearly £200 million paid in cyber claims (ransomware/malware share of claims): https://www.abi.org.uk/news/news-articles/2025/11/nearly-200-million-paid-in-cyber-claims-to-help-uk-businesses-recover/
Action Fraud — Reporting fraud and cybercrime: https://www.actionfraud.police.uk/
