You arrive at the office. Nothing works. A message appears: your files are encrypted, pay X bitcoins. What to do in the next 24 hours? Here is the action plan we apply with our clients.
Hour 0 — Isolate without shutting down
First reflex: isolate compromised machines from the network. Unplug Ethernet, disable WiFi, power off switches if needed. But DO NOT power off the machines themselves. Forensic analysis can recover RAM data that helps identify the ransomware strain and sometimes recover the key.
Hour 1 — Activate the crisis cell
Gather: executive, IT director or provider, HR, communications, legal. Name a single cell leader. Cut all uncontrolled external communication during diagnostics — no tweet, no LinkedIn post.
Hour 2 — Call the right contacts
- 17 / Police: file a complaint (mandatory for insurance and CNIL)
- Cybermalveillance.gouv.fr: free state-funded assistance
- Your IT services / cyber partner: immediate technical intervention
- Your cyber insurer: claim notification (contracts often require notice within 24–48h)
- ANSSI if you are an NIS2 essential entity (mandatory notification within 24h)
- CNIL if personal data is concerned (notification within 72h)
Hour 4 — Do NOT pay the ransom
Paying doesn't guarantee recovery (30% of payments yield nothing per ANSSI). Paying funds organized crime and exposes you legally (terrorism financing in some jurisdictions). Paying signals to attackers that you are an easy target — frequent re-victimization.
Hour 6 — Technical diagnostic
Identify the ransomware strain (LockBit, BlackCat, Akira, etc.), the entry vector (phishing, exposed RDP, unpatched software exploit), the spread (1 workstation? all servers? the AD?). This analysis conditions everything that follows.
Hour 8 — Remediation plan
Three scenarios depending on compromise depth: (1) restore from validated immutable backup — best case, 24–48h cutover; (2) partial rebuild of compromised environments + data restore only — 3–7 days; (3) full rebuild AD + endpoints + servers — 1 to 3 weeks, worst case.
Hour 24 — Internal and external communication
Inform employees (reassure + frame external communication). Inform critical clients with a factual, professional message. Prepare a legally pre-validated communiqué if the incident becomes public. Professional transparency protects reputation better than silence.
And after?
Once the crisis is handled, the post-mortem begins: chronological reconstruction, root cause identification, remediation plan to prevent recurrence. All organizations we support after an incident come out stronger — the pain serves, provided the lessons are drawn.