Ransomware attack: what to do in the first hour
A ransom note on the screen, or files that suddenly cannot be opened? What you do in the first hour determines how much damage is done. These are the steps, in order. Updated on 27 October 2026.
Why the first hour matters
Ransomware does not encrypt everything at once. It often moves from device to device, looking for network shares and backups. The faster you stop it spreading, the less damage it does. At the same time you do not want to destroy evidence needed for investigation, recovery and any report you have to make. Hence this order.
The steps in the first hour
- 01
Isolate affected devices
Unplug the network cable and switch off Wi-Fi. Do not shut the device down: its memory holds evidence you will need later.
- 02
Call for help
Call your IT partner or incident response team. Use a phone or a clean device, not email that may be compromised.
- 03
Secure your backups
Disconnect backup drives and NAS from the network and check that they are untouched before you do anything with them.
- 04
Block access
From a clean device, change the passwords of admin accounts and block accounts that behave strangely.
- 05
Record everything
Note the times, photograph the ransom note and write down what you saw and did.
- 06
Report on time
If personal data is involved, report it to the Dutch Data Protection Authority within 72 hours. If you fall under the Dutch Cybersecurity Act, send an early warning to the CSIRT and your regulator within 24 hours. Also report it to the police.
What not to do
Do not pay straight away
Paying is no guarantee you will get your data back, and it funds new attacks.
Do not shut down or wipe
Shutting down or reinstalling destroys the evidence needed to see how the attacker got in.
Do not restore too early
Do not restore a backup until it is clear how the attacker got in. Otherwise it starts all over again.
Not through compromised email
Attackers sometimes read along. Talk by phone or through a separate channel.
Prepare: arrange this before an attack
- Your IT partner's emergency number on paper, not only on the computer
- A backup stored offline or immutable
- A short incident plan: who decides, who calls whom
- Contact details of the NCSC, your regulator and the data protection authority
- An exercise with the whole team once a year
How Xcitium prevents this
The best first hour is the one you never need. ZeroDwell runs unknown files in isolation, so ransomware cannot encrypt anything. If something does happen, the Xcitium 24/7 SOC steps in immediately, with no hourly rate.
- ✓ ZeroDwell against unknown ransomware
- ✓ Protection of network shares and NAS
- ✓ A 24/7 SOC that steps in immediately
- ✓ Help with investigation and recovery
Complete your coverage
Preventing ransomware
Ten measures against ransomware, in order of impact.
ViewManaged EDR
24/7 SOC that monitors your endpoints, investigates and acts immediately.
ViewZeroDwell containment
Unknown files run in a virtual environment until it is clear whether they can be trusted.
ViewNetwork Share Protection
Protection of file servers and NAS against encryption from any device.
ViewFrequently asked questions
Should I pay the ransom?
The advice of the Dutch NCSC and police is: preferably not. There is no guarantee you will get your data back and you fund new attacks. Always consult your incident response team first.
Can I decrypt my files myself?
Sometimes. nomoreransom.org, an initiative of Europol and the Dutch police, offers free decryptors for known variants. Only use them after consultation, so you do not destroy evidence.
Do I always have to report it?
A data breach involving personal data must be reported to the data protection authority within 72 hours. If you fall under the Dutch Cybersecurity Act, you also have to report to the CSIRT and your regulator. We always recommend reporting it to the police.
Can Spiredesk help during an attack?
Yes. Call us and we coordinate with you and the Xcitium SOC. Customers with Managed EDR get incident response with no hourly rate.
Ransomware attack: the first hour in your environment?
In a short demo we show you how it works, discuss your situation and make a proposal. No obligation, in English or Dutch.
Product information: xcitium.com. Xcitium, ZeroDwell, OpenEDR and related logos are trademarks of Xcitium Inc.