Ransomware: The First 72 Hours
Most ransomware response advice on the internet is either marketing fluff or generic CISA references. This guide is what we actually do, hour by hour, when a Texas SMB calls us in the middle of an active ransomware incident.
Key points
We cover the first 60 minutes (containment without making things worse), the first 8 hours (scope, stabilize, documentation), the first 24 hours (containment hardening, forensics, executive and legal notification), and the first 72 hours (eradication, recovery, regulatory disclosure cycle).
The decisions you make in the first three days determine whether the incident becomes a contained operational event or an existential threat to the business.
The single best preparation: deploy Privileged Access Management (PAM) before the incident so the encryption never executes.
Ransomware response · Hour by hour
Seventy-two hours, one decision at a time
Six windows, in the order we work them: contain, scope, preserve, rebuild, notify and harden. Tap a lens to dive in, use the arrows, or let it play.
The playbook · Hour 0 to day 3
Three days, six windows, and a plan for each one
Ransomware doesn't wait while you hunt for a phone number. The first three days split into windows, each with its own job: contain, scope, preserve, rebuild, notify, then harden. Without a plan, each window opens late. Flip between the two and watch the bars slide.
What LayerLogix does
- Run the hour-by-hour playbook with you from the first call
- Build IR capability into your managed services baseline
- Line up your carrier hotline and backups before day one
Hour 0–1 · Contain without losing evidence
Unplug the machine. Don't switch it off.
Your first instinct is the power button. Resist it. Shutting down wipes what's held in memory: running processes, open connections, sometimes the attacker's own tools. Pull the cable, kill the Wi-Fi and isolate the VLAN instead, then call your carrier before anything irreversible.
What LayerLogix does
- Tell you which cables, Wi-Fi and VLANs to cut, in what order
- Keep infected machines powered on so memory can be captured
- Get your carrier hotline and the IR team on the line
Hour 1–8 · Scope, stabilize, write it down
Six questions, answered and logged as you go
Who did this, with which tool, and did they copy data out before encrypting it? What's hit, and are your immutable backups intact? Each answer goes into a timestamped incident log, because your insurer, regulators and lawyers will all ask. Pick a reader to see what they look for.
What LayerLogix does
- Identify patient zero, the encryption tool and the group behind it
- Check for signs data left before the encryption started
- Keep the incident log: each decision, action and timestamp
Hour 8–24 · Lock it down, preserve evidence
Confirm they're out. Then copy the crime scene.
Isolating the obvious machine isn't the end of containment. Attackers may leave a way back in, like a quiet scheduled task waiting to phone home. Enhanced monitoring across the rest of the network is how you catch it, while disk and memory images of patient zero are sealed as evidence.
What LayerLogix does
- Confirm lateral movement has stopped before anything restores
- Deploy enhanced monitoring across the broader environment
- Take disk and memory images of patient zero and key systems
Day 1–3 · Decide, then rebuild
Decrypt with their tool, or rebuild from clean backups?
The attacker's decryptor is slow, may not bring every file back, and runs their code on your servers. Rebuilding from immutable backups is the usual answer. We restore in stages and check each system is clean before it reconnects. The ransom call is made with your carrier and counsel.
What LayerLogix does
- Run a staged restore from your immutable backups
- Check each system is clean before it reconnects to production
- Give your carrier and counsel the facts for the ransom decision
Day 1–3 · Notification and disclosure
Who hears about it, and who decides when
Your cyber insurance carrier comes first, inside the window your policy sets. Reports to CISA and the FBI's IC3 are voluntary but worth filing. After that it depends on your industry and your state: HHS, the FTC, the SEC, state attorneys general. Pick a business type to see the board change.
What LayerLogix does
- Build the technical timeline your carrier and counsel will need
- Gather the details for your CISA and FBI IC3 reports
- Flag early when data left, so counsel can start the review
Day 3+ · Lessons and hardening
The review finds the gaps. The plan closes them.
Once systems are back, the post-incident review asks how they got in, what let them spread, what held and what didn't. Each gap becomes a fix. The one we push hardest is privileged access management with application allowlisting, so an unapproved encryption tool is blocked before it runs.
What LayerLogix does
- Run the post-incident review and trace the way they got in
- Close the gaps: PAM, MFA, EDR coverage and segmentation
- Test-restore your immutable backups on a schedule
Showing The playbook · Hour 0 to day 3: Three days, six windows, and a plan for each one
What We Offer
Comprehensive solutions tailored for Houston-area businesses
Hour 0-1: Containment
Disconnect affected systems from the network — pull cables, kill WiFi, isolate VLANs. Do NOT shut down (memory forensics value is lost). Identify the source endpoint, the spread pattern, and the encryption tool. Engage your incident response team or external IR firm. If you have a cyber insurance policy, call the carrier hotline before doing anything irreversible — most policies require carrier-approved IR firms.
Hour 1-8: Scope & Stabilize
Identify the threat actor (ransom note attribution), confirm the encryption tool variant, assess data exfiltration evidence (most modern ransomware groups exfiltrate before encrypting — double extortion), inventory all affected systems, identify your immutable backups, confirm backup integrity. Begin executive and legal notification. Begin documentation — every decision and timestamp matters for insurance, regulators, and possible litigation.
Hour 8-24: Containment Hardening & Forensics
Confirm containment is complete (no lateral movement continuing). Deploy enhanced monitoring on the broader environment to catch any persistence the adversary may have established. Begin forensic preservation — disk and memory images of patient zero and key affected systems. Begin rebuild planning. If exfiltration is confirmed, engage data review counsel for the inevitable disclosure analysis.
Day 1-3: Eradication & Recovery Decisions
Make the rebuild-vs-decrypt decision (almost always rebuild from clean backups; never trust decryption tools provided by the adversary). Begin staged recovery from immutable backups. Validate clean state before reconnecting recovered systems to production. Make the ransom-payment decision — see FAQ; the answer is almost always no, but the analysis depends on backup state, exfiltration severity, OFAC sanctions exposure, and regulatory posture.
Day 1-3: Notification & Disclosure
Notify cyber insurance carrier (within 24-48 hours per most policies). Notify CISA (voluntary but increasingly expected). Notify FBI Internet Crime Complaint Center (IC3). For specific industries: HHS Office for Civil Rights for HIPAA-covered entities; FTC for FTC Safeguards Rule-covered entities (within 30 days for incidents affecting 500+ consumers); state attorneys general per state breach notification laws; SEC if you are publicly traded.
Day 3+: Lessons & Hardening
Conduct a post-incident review. Identify the initial access vector. Identify the gaps that allowed lateral movement. Identify the controls that worked and the controls that did not. Build the remediation plan: PAM deployment if absent, MFA enforcement gaps, EDR coverage gaps, identity hardening, immutable backup validation, network segmentation. The post-incident hardening is the single highest-leverage security investment most organizations ever make.
Why Choose LayerLogix?
Serving businesses throughout the Greater Houston area including Houston, The Woodlands, Sugar Land, Spring, Conroe, Pearland, Katy, Dallas, Fort Worth, Austin, San Antonio.
Faster Recovery, Lower Cost
Organizations with a documented incident response plan and tested procedures recover 50-70% faster and at a fraction of the cost of organizations winging it. The IR firm bills the same regardless of how prepared you are; what changes is how many billable hours you need.
Defensible Insurance Claims
Cyber insurance claims hinge on documented response. Carriers require carrier-approved IR firms, specific notification timelines, and documented decision-making. Organizations that follow the process get paid; organizations that improvise get pushback or denials.
Regulatory Compliance
HIPAA OCR, FTC Safeguards Rule, state breach notification laws, SEC disclosure requirements — each has specific timelines and documentation requirements. Missing a deadline turns a contained incident into a regulatory enforcement problem.
Operational Continuity
Containment + parallel recovery means business operations resume in days, not weeks. Without a plan, the rebuild-from-scratch path takes 4-8 weeks for a typical SMB.
Litigation Defensibility
Post-incident litigation (from customers, partners, employees, shareholders) is increasingly common. Documented response, proper preservation of evidence, and engagement of qualified outside counsel are all part of a defensible record.
Our Process
Frequently Asked Questions
Should I pay the ransom?▼
Do I need to call the FBI?▼
When do I have to notify customers, regulators, or the public?▼
How long does ransomware recovery take?▼
What is the most important thing to have in place before an incident?▼
Should we engage a retainer with an IR firm in advance?▼
Do you provide Ransomware: The First 72 Hours in Houston and nearby areas?▼
What does Ransomware: The First 72 Hours cost for a Houston business?▼
Ready to Get Started?
Contact LayerLogix today for a free consultation. We serve businesses throughout Houston, The Woodlands, Sugar Land, and the surrounding Greater Houston area.