What Is Ransomware Response?

The First 24 Hours: Containment and Assessment

The first priority in a ransomware response is containment — preventing the ransomware from spreading to additional systems while preserving forensic evidence. This requires isolating affected systems from the network, identifying the initial access vector (how did the attacker get in?), determining the scope of encryption, and assessing whether the attacker still has active access to the environment.

Critically: ransomware encryption is typically the last stage of a multi-week attack. By the time files are encrypting and the ransom note appears, the attacker has usually been in the environment for days or weeks — conducting reconnaissance, stealing data, identifying backup systems, and positioning for maximum impact. The encryption event is not the beginning of the incident. It is the end of the attacker's preparation phase.

This means that the first response question — 'what systems are affected?' — is significantly harder to answer than it appears. The attacker may have accessed systems that show no encryption. Credentials may be compromised beyond the identified blast radius. Data may have been exfiltrated before encryption began. Forensic investigation is required to establish the true scope, and that investigation takes time that feels interminable under board pressure for immediate answers.

The Ransom Decision

The decision of whether to pay a ransom is one of the most consequential and legally complex decisions in ransomware response. Several factors bear on it.

OFAC compliance. The US Treasury's Office of Foreign Assets Control maintains a list of sanctioned entities. Paying ransom to a sanctioned threat group — which includes several major ransomware operators — may violate OFAC regulations regardless of intent. The legal obligation to check the ransomware group against the OFAC SDN list before any payment decision is non-negotiable. This requires legal counsel involvement before the ransom decision is made.

Backup viability. If backups are intact, isolated, and tested, paying the ransom provides little operational value — the organization can recover from backups. If backups were encrypted or destroyed by the attacker (which sophisticated operators do systematically), paying for the decryptor may be the fastest recovery path. Backup viability assessment is the first technical question that informs the ransom decision.

Data exfiltration. Most sophisticated ransomware operators now use double extortion: they encrypt files AND threaten to publish stolen data if the ransom is not paid. If sensitive customer data, regulated data, or strategically significant information was exfiltrated, paying the ransom for a 'promise' not to publish provides no legal protection — the data is still in the attacker's possession regardless of payment.

Regulatory Notification Requirements

Ransomware attacks trigger notification obligations that are independent of whether data was actually accessed or exfiltrated. The key frameworks: SEC rules require public companies to disclose material cybersecurity incidents within four business days of determining materiality. State breach notification laws require notification when personal information was 'accessed or acquired' — most ransomware incidents involving systems that contain personal data trigger this standard regardless of whether exfiltration is confirmed. HIPAA requires breach notification within 60 days of discovery for covered entities. The EU GDPR requires notification to supervisory authorities within 72 hours of becoming aware of a breach affecting personal data.

The practical consequence is that most significant ransomware incidents require regulatory notification within days of detection — often before forensic investigation is complete enough to fully understand the scope. Legal counsel should be engaged within hours of confirmed ransomware detection, not after the technical response is complete.

Ransomware Recovery Sequencing

Recovery from ransomware follows a sequencing logic that is counterintuitive under pressure. The instinct is to restore everything immediately. The correct sequence is: restore critical business operations first (payroll, customer-facing systems, supply chain), then internal productivity systems, then administrative systems. Restoring everything simultaneously overwhelms IT capacity and may delay the systems that matter most to business continuity.

Before restoring any system from backup, the initial access vector must be identified and closed. Restoring systems from backups into an environment where the attacker still has active access results in re-encryption. This is not a hypothetical scenario — it is documented in multiple incident response after-action reports as one of the most costly mistakes in ransomware recovery.

The Board's Role in Ransomware Response

For boards, ransomware response preparedness requires three things before an incident occurs: an incident response plan with defined decision authorities (who approves the ransom decision? who authorizes regulatory notification?), tested backups with demonstrated recovery time objectives, and pre-engaged external resources (forensic firm, outside legal counsel with breach response experience, public relations counsel for crisis communications). Organizations that prepare these elements in advance recover materially faster than those that assemble them under pressure.

Related Reading

• What is Incident Response?
• What is Backup and Recovery?
• What is Cyber Insurance?
• What is DFIR?
• What is a Tabletop Exercise?

Frequently Asked Questions

Is it legal to pay a ransom?

Usually, but not always, and the exception is the one that matters. Paying a ransom is not itself a federal crime in the United States. Paying a sanctioned entity is. OFAC has designated several ransomware operators and the individuals behind them, and liability there is strict: it does not depend on whether you knew who you were paying. Treasury has said it will consider a prompt, complete report to law enforcement a mitigating factor, which is one of the practical reasons to involve the FBI early. The attribution work happens fast in real incidents, often inside a day, but it happens through counsel and the forensic firm. It is not a call the CFO makes from the wire room.

Who actually decides whether to pay?

Whoever the incident response plan says decides, which is why the plan needs to name a person and not a committee. In practice the decision is recommended by the incident commander, priced and evaluated by outside counsel and the forensic firm, and approved by the CEO or the board depending on the dollar threshold in the plan. Two things go wrong when this is undefined. The decision stalls while people establish who owns it, and the insurer is not consulted before a payment is authorized, which can void coverage for the payment entirely.

Does cyber insurance cover the ransom?

Extortion coverage is standard in most current policies, but it is conditional in ways that catch organizations out. Nearly every policy requires the insurer's consent before payment, requires use of an approved forensic firm and approved negotiator from the carrier's panel, and requires prompt notice of the incident. Calling your own forensic firm first because you trust them, then notifying the carrier afterward, is one of the most common ways coverage gets reduced. Find out who is on your carrier's panel before you need them, and confirm whether your preferred providers are already approved.

If our backups are good, do we still have a problem?

Yes, a different one. Clean backups solve the encryption problem. They do nothing about exfiltrated data. Most serious operators now steal before they encrypt, precisely because they know mature organizations can restore. A company with perfect backups can be fully operational in a week and still face the notification obligations, the regulatory exposure, the litigation and the customer calls, because the data is gone regardless of whether the files came back. Backups shorten the outage. They do not shorten the incident.

How long does recovery actually take?

Longer than the RTO on the slide. Published figures cluster around three weeks to a month for material incidents, and that is time to substantial operational recovery, not to normal. Full restoration of every system, with rebuilt identity infrastructure and closed access paths, commonly runs into months. The gap between the tested recovery time and the real one comes from things the test never includes: rebuilding domain controllers rather than restoring them, reissuing credentials across the entire workforce, validating that restored systems are clean, and doing all of it while the forensic investigation is still running and legal is holding certain systems for evidence.

Do we have to disclose that we paid?

It depends on who is asking. Breach notification statutes require you to notify affected individuals about the data, not about the payment. SEC disclosure for public companies turns on materiality of the incident, and a ransom payment large enough to matter financially is likely to be part of that analysis. Insurers must be told. The payment also tends to surface later through other routes: litigation discovery, congressional inquiry, or the threat actor publishing it. Organizations that plan the communications on the assumption the payment stays private are usually wrong.

What does a ransomware negotiator do that we cannot?

They know the counterparty. Specialist negotiators track which groups honor decryptors and which do not, what the real discount range is against the opening demand, how each operator handles proof-of-life file tests, and whether a given group has a history of re-extorting after payment. They also create distance, which is operationally useful: the executive team is not exchanging messages directly with the attacker, and the communications run through a channel counsel has structured. Most carriers require one anyway. The value is not haggling. It is knowing what the group on the other end has actually done to the last twenty companies.

What should we have in place before any of this happens?

Four things, and they take weeks to arrange in advance and days you do not have during an incident. A response plan that names decision authorities by role and sets dollar thresholds. Backups that are immutable or offline, and a recovery that has been tested end to end within the last year, not just spot-checked. Retainers signed with a forensic firm and breach counsel, both confirmed against your carrier's approved panel. And an out-of-band communications channel, because if the attacker is in your environment they are reading the email thread where you discuss how to respond to them.

Change Healthcare: When Ransom Payment Doesn't End the Crisis

UnitedHealth Group paid approximately $22M in ransom to the ALPHV/BlackCat ransomware group following the February 2024 Change Healthcare attack. The payment did not end the incident. The ransomware affiliate — separate from the ALPHV leadership — claimed they still had the stolen data and began threatening to publish it independently. UnitedHealth faced regulatory investigations, congressional testimony, class action lawsuits, and business continuity costs that pushed total incident costs well beyond $870M in the first reporting quarter. The Change Healthcare case illustrates two lessons that boards must internalize: paying ransom does not guarantee data security when double extortion is involved, and the true cost of a major ransomware incident is measured in multiples of the ransom payment itself.