1 min Reading Time<\/p>\n
Ransomware remains the biggest cyber threat to businesses. When the worst happens, the first 60 minutes determine the extent of the damage. A guide to the critical phase between detection and containment.<\/strong><\/p>\n The attack is detected – by an alarm from the EDR system, by employees reporting encrypted files, or by a ransom demand on the screen. Every minute counts now.<\/p>\n Immediate actions:<\/strong> Alert IT security personnel, activate the incident response team, document timestamps and initial observations. Do not panic – follow the prepared plan.<\/p>\n Immediately disconnect affected systems from the network – pull network cables, disable Wi-Fi. Important: Do not shut down systems, as volatile data in RAM is valuable for forensic analysis. Isolate network segments, block VPN access, and deactivate privileged accounts as a precaution.<\/p>\n Check if backup systems are affected. If not: immediately write-protect them. Attackers specifically target backups to strengthen their negotiating position.<\/p>\n Initial assessment: Which systems are affected? Which ransomware family? Are there Indicators of Compromise (IoCs)? Were data exfiltrated (Double Extortion)?<\/p>\n Start crisis communication: Inform management, activate external forensic service providers, contact a lawyer (reporting obligations!). If affected by NIS2: 24-hour deadline for the initial report to the BSI.<\/p>\n Start forensic preservation: memory images, log data, network captures. Identify the attack vector – phishing email, compromised RDP access, supply chain attack? In parallel, plan the restoration: check backup integrity, prepare a clean room environment, prioritize systems based on business impact.<\/p>\n Pay the ransom:<\/strong> Funds the criminals, no guarantee of decryption, makes the company a repeat target.<\/p>\n Shut down systems:<\/strong> Destroys forensic evidence in RAM.<\/p>\n Contact the attackers:<\/strong> Not without consulting forensic experts and a lawyer.<\/p>\n Panic communication:<\/strong> No hasty public statements without coordination with PR and legal departments.<\/p>\n The first hour cannot be improvised. Companies need a tested incident response plan with clear roles, contact lists (also available offline), regularly checked and offline stored backups, contractually secured forensic service providers on call, and a cyber insurance policy with clear terms.<\/p>\n Breakout Time:<\/strong> 48 minutes (CrowdStrike 2025)<\/p>\n Most Common Vector:<\/strong> Phishing, compromised RDP access, vulnerabilities<\/p>\n Double Extortion:<\/strong> Over 70% of ransomware attacks also exfiltrate data<\/p>\n NIS2 Reporting Obligation:<\/strong> 24-hour initial report to BSI<\/p>\n BSI Recommendation:<\/strong> Do not pay ransom<\/p>\n Backup Rule:<\/strong> 3-2-1 (3 copies, 2 media, 1 offsite\/offline)<\/p>\n Fact:<\/strong> The average downtime after a ransomware attack is 23 days, according to Sophos.<\/p>\n Fact:<\/strong> According to Chainalysis, companies paid over 1.1 billion US dollars in ransomware ransoms worldwide in 2025 – despite a decreasing willingness to pay.<\/p>\n Every question is locked. A tap unlocks the answer.<\/p>\n The BSI and BKA strongly advise against it. Payments fund the criminals, do not guarantee decryption, and make the company a preferred repeat target. Instead: Use backups, hire forensic experts, file a report.<\/p>\n<\/details>\n Under NIS2: 24 hours for the initial warning to the BSI, 72 hours for the detailed report. Data protection authorities (GDPR, 72h) and cyber insurance policies also have their own reporting deadlines.<\/p>\n<\/details>\n RAM contains volatile data such as encryption keys, active network connections, and process information. Shutting down destroys this evidence, which is crucial for forensics and possibly decryption.<\/p>\n<\/details>\n 3-2-1 rule: Three copies on two different media, one of them offline or immutable. Air-gapped backups are the best protection. Additionally: regular restore tests and separate backup credentials.<\/p>\n<\/details>\n According to IBM, a ransomware incident costs an average of 4.5 million Euros – without the ransom. Costs arise from operational disruption, forensics, legal advice, customer notification, and reputational damage.<\/p>\n<\/details>\n \u2192 Recognizing AI-Generated Phishing Emails: 7 Warning Signs for 2026<\/a><\/p>\n \u2192 Zero Trust for SMEs: Getting Started in 5 Steps<\/a><\/p>\n \u2192 Multi-Cloud Security 2026: The 5 Biggest Risks and How to Solve Them<\/a><\/p>\n Threat Landscape 2025: Cyberattacks Become More Aggressive (Security Today)<\/p>\n BSI KRITIS Reports: KRITIS 2024 at Risk<\/a> (Security Today)<\/p>\n Cloud Backup and Disaster Recovery: cloudmagazin.com<\/a><\/p>\n Business Continuity Strategies: mybusinessfuture.com<\/a><\/p>\n More from the MBF Media Network<\/p>\nTL;DR<\/h2>\n
\n
Minute 0-15: Detection and Alert<\/h2>\n
Minute 15-30: Isolation and Containment<\/h2>\n
Minute 30-45: Situation Assessment and Communication<\/h2>\n
Minute 45-60: Forensics and Restoration Planning<\/h2>\n
What You Should Never Do<\/h2>\n
Preparation is Key<\/h2>\n
Key Facts at a Glance<\/h2>\n
Frequently Asked Questions<\/h2>\n
Should you pay the ransom?<\/strong><\/summary>\n
How quickly must we report the incident?<\/strong><\/summary>\n
Why should you not shut down systems?<\/strong><\/summary>\n
How do you protect backups from ransomware?<\/strong><\/summary>\n
What does a ransomware attack cost?<\/strong><\/summary>\n
Further Articles on the Topic<\/h2>\n
Further Reading in the Network<\/h2>\n
Related Articles<\/h2>\n
\n