Ransomware attack: what to do in the first 72 hours

Monday, 7:40 am. Reception calls: the screen says “your files are encrypted”. From that moment, every decision counts, and some of them multiply the damage: switching everything off, paying in a panic, reinstalling before you understand what happened. Here are the first 72 hours of a ransomwareRansomwareMalware that encrypts an organisation’s data and demands a ransom to restore it, often also threatening to publish the stolen data. attack, for a small business without a dedicated security team. Print this page: on the day, your network may no longer be available.

128

Source: ANSSI, Cyber Threat Overview 2025

How the attack is prepared beforehand is covered in our chapter on ransomware.

The timeline at a glance

When	Priority	Key actions
H+0 to H+1	Contain	Isolate without switching off, cut the Internet, unplug backups, start an incident log
H+1 to H+4	Alert and organise	IT provider, 17Cyber, insurer, crisis team, backup channel
H+4 to H+24	Understand and preserve	Evidence, scope, personal data involved, message to staff
H+24 to H+72	Meet your obligations	Police complaint, notification to the CNIL, customers and partners
After H+72	Recover properly	Entry point closed, systems rebuilt, every secret changed

These slots are indicative: legal deadlines start when you become aware of the attack, not when the analysis is finished.

H+0 to H+1: contain without destroying

The first hour has one purpose: stop the attack spreading without erasing what will help you understand it.

1. Disconnect affected machines from the network (cable, Wi-Fi), but do not switch them off: their memory holds traces that investigators need. If encryption is visibly still running, Cybermalveillance.gouv.fr, the French government’s victim assistance service, recommends hibernation rather than a hard shutdown.
2. Cut the Internet connection of the affected network (router) and remote access (VPN, remote desktop). The attacker loses control of their tools and can no longer take data out.
3. Unplug backups that are still connected: they are often the first target.
4. Do not switch on machines that were already off: they may be clean, so keep them that way.
5. Start an incident log, on paper or on a device that is not connected to the network: time, observation, action, who did it.

Incident log · ransomware
07:40  Reception (S. Leroy)  Ransom screen on PC-RECEPTION-02, photo taken
07:46  IT (K. Diallo)        PC-RECEPTION-02 disconnected from network, left on
07:52  IT (K. Diallo)        Internet router switched off, backup NAS unplugged
08:05  Management (A. Morel) Crisis team called for 08:30, room B

This log will serve investigators, your insurer and the lessons-learned review.

Meanwhile, on the attacker’s side

Encryption is only the end of the attack. Before it, the attacker has often spent days extending their privileges, moving from machine to machine (lateral movementLateral movementThe techniques an attacker uses to move from a first compromised machine to others on the network, until reaching the real targets.), copying data and destroying backups. In the hours that follow, they may still be connected, reading your messages and preparing to publish the stolen data.

H+1 to H+4: raise the alarm and get organised

Set up the crisis team

Even in a twenty-person business, someone has to decide. At the very least, name a decision-maker (the managing director, who rules on shutting down activities, spending and public statements), a technical lead (in-house IT or your provider), someone to keep the log, and someone to handle the formalities: police complaint, insurer, data protection authority, messages to staff and customers.

Choose a backup channel (phone, a messaging service independent of the affected systems) and assume your usual email is being read.

Who to call, and why

Contact	When	What for
Your IT provider or department	Immediately	Containment, first findings
17Cyber (French police, gendarmerie and Cybermalveillance.gouv.fr)	Within the first hour	Diagnosis, advice, contact with law enforcement and with an accredited ExpertCyber provider
Your insurer (cyber policy helpline)	As soon as possible	Claim notification, emergency assistance if your policy includes it
Your regional CSIRTCSIRT / CERT (incident response team)A team dedicated to responding to security incidents for a given constituency (a company, a sector, a region, a country), which warns, advises and coordinates the response.	If you are a mid-sized company, local authority or non-profit	Referral to local assistance
CERT-FR (ANSSI), on 3218 or +33 9 70 83 32 18	If you are a public body, an operator of vital importance or a regulated entity	Reporting and support, 24/7
Your bank	As soon as possible	Watch for the transfer fraud that often follows

Your insurance policy sets the deadline for notifying a claim, which under French law cannot be shorter than five working days (Article L113-2 of the Insurance Code). Do not wait: assistance only starts once you call, and ask whether the insurer will cover the incident responseIncident responseThe organised set of actions taken to detect an attack, limit the damage, drive the attacker out, restore operations and learn the lessons. provider you intend to hire.

H+4 to H+24: understand and preserve evidence

If you do not know how the attacker got in, you risk restoring a system they still control. The first hours of digital forensicsDigital forensicsThe discipline of collecting, preserving and analysing digital traces (disks, memory, logs) to reconstruct what happened during an incident, rigorously enough for the evidence to stand up in court. aim to answer four questions: how did they get in, since when, what did they touch, what did they take?

Keep, or have a professional keep:

• logs from the firewall, proxy, VPN and Active DirectoryActive Directory (AD)Microsoft’s directory service, which centralises the accounts, passwords and permissions of most corporate Windows networks: whoever controls it controls the whole network., exported before they are overwritten;
• the affected machines or copies of their disks;
• the ransom note and a few encrypted files: a decryption tool may be published later, for example on the No More Ransom portal, in which Europol takes part;
• the incident log.

Do not reinstall anything yet: Cybermalveillance.gouv.fr asks victims to file their police complaint before reinstalling affected devices.

Check for personal data

Even a business with no customer database holds payslips, bank details and staff records. If the attacker could access, copy or destroy them, this is a personal data breach under the GDPRGDPRThe EU regulation, applicable since 25 May 2018, that governs the use of personal data and requires every organisation to protect it with security measures appropriate to the risk.. Start gathering what the CNIL will ask for: the nature of the breach, the categories and approximate number of people and records involved, the likely consequences and the measures taken.

Talk to your staff

A short message, the same day: what is happening, as far as it is confirmed; what to do (do not switch on a machine that is off, do not plug in any USB stick, report any suspicious message); who to contact. Silence breeds rumours.

H+24 to H+72: police complaint, CNIL and customers

File a complaint before the 72nd hour

72 h

Source: French Insurance Code, Article L12-10-1

Since 24 April 2023, Article L12-10-1 of the French Insurance Code, introduced by the interior ministry programming law (known as LOPMI) of 24 January 2023, makes any insurance payout for a cyber attack conditional on a complaint filed no later than 72 hours after the victim became aware of it. The rule applies to companies and to individuals acting in a professional capacity.

File the complaint at a police or gendarmerie station, or in writing to the public prosecutor. Bring the incident log, the ransom note and the first technical findings.

Notify the CNIL

Article 33 of the GDPR requires a breach that poses a risk to people to be notified without undue delay and, where feasible, no later than 72 hours after becoming aware of it. In France, this goes through the CNIL’s online notification service. Do you not have all the answers yet? Send an initial notification, then complete it. Beyond 72 hours, you will have to explain the delay.

If the risk to people is high, for example when bank or health data has been stolen, Article 34 also requires you to inform the people concerned. If in doubt, notify: the CNIL will tell you whether this is necessary. And even without notification, every breach must be documented internally.

Inform customers and partners

Stick to the facts, without speculating about the attacker or the volume of data affected, and speak with a single voice. Warn first the customers and suppliers you exchange files or access with: the attacker may use your contacts for booby-trapped messages or payment fraud. ANSSI’s guide on cyber crisis communication, revised in French in June 2026, offers ten practical sheets.

After 72 hours: rebuild on clean foundations

Restarting everything quickly is the best way to be encrypted a second time.

• Close the way in before reopening anything: patch applied, exposed service removed, multi-factor authentication added.
• Rebuild rather than clean: reinstall affected systems from trusted sources, then restore data from a backup taken before the attack and checked to be clean.
• Change every secret, from a clean machine: admin and service accounts first, then all users, API keys, certificates and supplier access. If Active Directory was compromised, Microsoft recommends resetting the password of the krbtgt account, which signs Kerberos authentication tickets, twice in rapid succession: it keeps the previous password, so a single change is not enough.
• Restart in stages, beginning with priority activities, and watch closely for any new attempt.
• Run a lessons-learned review: what worked, what was missing, and a dated action plan.

To go further, see our chapter on handling an incident.

What you should have ready beforehand

Everything above goes better when it has been prepared in calm conditions:

Prepare	Why	How to check
A one-page response sheet, printed and displayed	The right first move should not depend on who happens to be there	Ask an employee what they would do faced with a ransom screen
A paper crisis directory	Email and online directories may be unavailable	IT provider, insurer and policy number, bank, 17Cyber, regional CSIRT
An offline or immutable backup, following the 3-2-1 rule3-2-1 backup ruleA simple backup rule: 3 copies of your data, on 2 different types of media, with 1 kept off-site.	A NAS that is always connected will be encrypted with everything else	A full restore tested, stopwatch in hand
An incident response provider chosen in advance	Signing a contract mid-crisis wastes hours	Contract or contact agreed, compatible with your insurance
A two-hour tabletop exercise	A crisis team meeting for the first time on the day loses time	Scenario played through, roles known, contacts tested

Finally, reduce the ways in. For businesses, Cybermalveillance.gouv.fr notes, attacks most often come through services exposed to the Internet (VPN, remote desktop, edge devices) with an unpatched flaw. KrakenShield’s attack surface audit and non-destructive penetration test, run only with your written authorisation, look for those flaws before attackers do: see what we check.