# Ransomware: what to do in the first hour Get the right people working together while they limit damage, protect evidence and check reporting duties. The Assurance Desk. Published 8 October 2026. Last checked 8 October 2026. Part of the guide [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md). **The short answer.** Bring in your incident lead and technical responders, set up communication you can trust and start a record of decisions. Containment needs to balance safety, business impact and evidence. Investigate before restoring systems where possible, so the findings can guide recovery ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). ## What should happen in the first hour? The first hour is about getting the response under way. Give someone clear authority to coordinate it. The National Cyber Security Centre, or NCSC, recommends using an NCSC assured Cyber Incident Response provider to help investigate ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). Find out which critical business functions are affected. If normal email or chat cannot be trusted, arrange another way for staff and responders to communicate ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). **Work that can run alongside the investigation** - **Coordinate**: Direct the response and weigh business and safety impacts. (Name who can make decisions.) - **Investigate and contain**: Bring in technical responders to assess the attack. (Use specialist help where available.) - **Communicate and record**: Keep a trusted route for updates and a central incident log. (Record decisions, reasons and actions.) - **Check reporting**: Check legal duties and insurer requirements. (Give the task a named owner.) Divide these jobs between named people. Keep decisions coordinated; this is not a set of timed slots. Source: NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities, https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities (checked 8 October 2026) ## Should you disconnect computers or shut them down? Disconnecting and shutting down have different effects. Technical responders should weigh the choice against safety, the damage still happening and the evidence needed to understand the attack ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). **Disconnecting and powering off** - **Disconnect from networks** - Can block further attacker commands and limit spread. - Can preserve evidence for the investigation. - May not stop harmful activity already running. - **Shut systems down** - May halt active processes. - Can lose evidence needed for the investigation. - Can make it harder to confirm that the attacker has gone. Neither action is a universal answer. The decision needs the facts of the incident and specialist input where available. Source: NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities, https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities (checked 8 October 2026) ## Who keeps the response moving? A clear lead keeps decisions coordinated while the people with the right skills do the work. Use a trusted route for updates and keep a central record of what is agreed ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). Lisa Forte puts the chair’s job plainly in her LinkedIn post ([Lisa Forte on LinkedIn](https://www.linkedin.com/posts/lisa-forte_one-of-the-most-common-mistakes-i-see-in-activity-7495389303716433920-sy4d), checked 8 October 2026). > "The chair's role isn't to have all the answers. It's to get the best answers from the people around the table." > Lisa Forte, LinkedIn post excerpt > Lisa Forte on LinkedIn, One of the most common mistakes I see in cyber exercises is a chair who tries to solve the incident themselves. That's not the chair's job. In one exercise we facilitated, the chair became the…, Lisa Forte, 12 comments, https://www.linkedin.com/posts/lisa-forte_one-of-the-most-common-mistakes-i-see-in-activity-7495389303716433920-sy4d (checked 8 October 2026) > [View LinkedIn post](https://www.linkedin.com/posts/lisa-forte_one-of-the-most-common-mistakes-i-see-in-activity-7495389303716433920-sy4d) ## What should go in the incident log? The incident log should record what was found, when it was found, who made each decision and why. Keep agreed actions and their status in the same record ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). **Prompts for the first incident record** | Record | Question to answer | | --- | --- | | Finding | What has been discovered? | | Time | When was it discovered? | | Decision | What was decided, by whom and why? | | Action | What was agreed and what is its current status? | Source: NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities, https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities (checked 8 October 2026) ## Can you recover from backups straight away? Check the backups before recovery starts. Find out when they were taken, whether they are available and whether the attack has affected them. Where possible, the investigation should come before restoration ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). The NCSC says backups should connect only to devices known to be clean. Scan the backups for malicious software before restoring files. Having a backup is a starting point for these checks ([NCSC, Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks), checked 8 October 2026). ## When does a UK ransomware incident need reporting? Check the reporting duties as the response starts. An NCSC incident report does not meet separate legal reporting requirements. Check your cyber insurer’s requirements too ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). For UK personal data, loss of access can matter as well as theft. The ICO says a personal data breach can affect confidentiality, accuracy or availability. Assess the risk to the people whose data is involved ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 8 October 2026). In the UK, a controller decides why and how personal data is used. A processor handles that data on the controller’s behalf ([ICO, What are ‘controllers’ and ‘processors’?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/), checked 8 October 2026). UK controllers must report a notifiable breach to the ICO without undue delay. They must report no later than 72 hours after becoming aware of it. A processor must tell its controller without undue delay after becoming aware ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 8 October 2026). The ICO allows required information to follow in phases without undue further delay. Record all personal data breaches, including those that do not need an ICO report. The separate reporting guide explains the risk test in more detail ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 8 October 2026). ## What to do 1. Bring together the incident lead, technical responders and specialist help ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). 2. Arrange a trusted way to share updates ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). 3. Assess containment with safety, evidence and business impact in view ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). 4. Start the incident record and check reporting and insurer requirements ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). 5. Check the investigation findings and backup safety before restoration ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities) and [NCSC, Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks), checked 8 October 2026). ## Common questions ### Does every ransomware attack need an ICO report? The UK test is whether there has been a personal data breach with a likely risk to people’s rights and freedoms. That assessment includes loss of access, not just stolen files. Record the breach even if it does not need reporting ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 8 October 2026). ### Can we wait for the full investigation before reporting? Do not wait past the UK deadline for a notifiable breach. The ICO requires a report without undue delay and no later than 72 hours after awareness. Missing details can follow in phases without undue further delay ([ICO, Personal data breaches: a guide](https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/), checked 8 October 2026). ### Should we pay the ransom? The NCSC says law enforcement does not encourage or endorse ransom payments. Bring the incident to specialist responders and check the relevant legal and insurer requirements ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities) and [NCSC, Mitigating malware and ransomware attacks](https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks), checked 8 October 2026). ### Will the business be back to normal in an hour? This guide gives first-response priorities, not a recovery deadline. Investigation findings, affected business functions and the state of backups need to inform recovery decisions ([NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities](https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities), checked 8 October 2026). ## Where next - [After a ransomware or security incident](https://theassurancedesk.com/best/security-incident.md) - [After a breach or ICO contact](https://theassurancedesk.com/best/post-breach.md) - [Incident response plan: what to write down](https://theassurancedesk.com/guides/incident-response-plan-what-to-write-down.md) - [A data breach has happened: who do you call?](https://theassurancedesk.com/guides/data-breach-who-to-call.md) - [When must you report a personal data breach?](https://theassurancedesk.com/guides/personal-data-breach-when-to-report.md) - [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md) ## Sources - NCSC, Disruptive cyber attacks, reducing their impact, reducing the risk, Recovering from a highly disruptive cyber attack, 1. Immediate activities: https://www.ncsc.gov.uk/collection/disruptive-cyber-attacks/recovering/1-immediate-activities (checked 8 October 2026) - Lisa Forte on LinkedIn: https://www.linkedin.com/posts/lisa-forte_one-of-the-most-common-mistakes-i-see-in-activity-7495389303716433920-sy4d (checked 8 October 2026) - NCSC, Mitigating malware and ransomware attacks: https://www.ncsc.gov.uk/guidance/mitigating-malware-and-ransomware-attacks (checked 8 October 2026) - ICO, Personal data breaches: a guide: https://ico.org.uk/for-organisations/report-a-breach/personal-data-breach/personal-data-breaches-a-guide/ (checked 8 October 2026) - ICO, What are ‘controllers’ and ‘processors’?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/ (checked 8 October 2026) --- **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.