The ransom note is on the screen. Files won’t open. Somewhere between your stomach dropping and the first phone call, a clock starts — and what happens in the next 72 hours largely determines whether this becomes a hard week or a defining catastrophe. How these attacks build up is one article; this one is the other side: you’ve just discovered it, hour zero, go. (And if you have a one-page incident plan, most of what follows is already printed and taped inside a cabinet. That’s the point of it.)

Hours 0–2: Contain, preserve, call

Disconnect, don’t power off. Unplug network cables or kill Wi-Fi on affected machines — and if encryption is visibly spreading, isolating the network at the switch or firewall is legitimate triage. But leave machines running: memory holds encryption keys and attacker artifacts that forensics needs, and powering off destroys them. The instinct to “turn it all off and wipe it” is the first classic mistake.

Hands off the backups — in a specific way. Don’t rush to connect backup drives or log into backup consoles from potentially compromised machines; if the attacker is still active, you’d be introducing them to the one thing they may have missed. Verify backup integrity from a known-clean device.

Start the call list, in order: your IT provider or team (for monitored clients, this call often goes the other direction — containment may already have happened at 2 a.m.); then your cyber insurer’s breach hotline — before hiring anyone, because most policies require prompt notice, fund the response, and often mandate using their panel of counsel and forensics (late or freelance response can jeopardize the claim); then counsel, per the insurer’s direction.

Start a log. Time-stamped notes of what was seen, done, and decided — one person’s job. It feels absurd mid-crisis; it’s gold for forensics, the claim, and the notification analysis.

Hours 2–12: Scope, communicate, resist the urge to negotiate

With responders engaged, the questions become: how far did it spread, what do the logs show about when they got in, what data may have left (modern crews steal before encrypting — assume exfiltration until proven otherwise, because notification law hangs on it), and — the pivotal one — did a clean backup survive? This is the hour the immutable copy and the restore-test log either pay for themselves or teach an expensive lesson.

Meanwhile, the communication plan runs its parallel track: staff told what’s known and what not to say, the holding line for inbound calls, clients on affected work told honestly with a next-update time. Nobody talks to the attackers yet. The note’s chat link and countdown are pressure engineering; visiting it prematurely tips your hand, and any contact belongs to the professional negotiators your insurer brings — who know the crews, their real (always lower) settlement ranges, and their reliability histories.

Hours 12–72: The decision, and the rebuild

By day two, the fork is visible: restore or negotiate. With a surviving clean backup, the answer is almost always restore — into a cleaned environment, in priority order (the tiers your RTO/RPO planning set), on rebuilt or verified-clean systems with every credential rotated, because restoring data onto machines that still hold the attacker’s access is how week two happens. Without viable backups, the negotiation question gets decided by the full room — insurer, counsel, forensics, leadership — weighing the downtime number, legal exposure (payments to sanctioned entities are illegal — counsel checks), and the unlovely realities: decryptors are slow and buggy, stolen data may leak anyway, and payment marks you as a payer. Law enforcement advises against paying; some businesses conclude they have no choice; the entire purpose of backup discipline is never being that business. Either way, report to the FBI at ic3.gov — occasionally they hold decryption keys from takedowns, and the report costs nothing.

By hour 72, a handled incident looks like: spread contained, forensics working the how, restores running in priority order, clients hearing scheduled updates, and the notification question in counsel’s hands. Weeks of cleanup remain — but the trajectory is set.

The mistakes that make it worse (all common, all avoidable)

Wiping machines before forensics sees them (destroying the how-they-got-in answer — leave the door open and they return) · restoring onto still-compromised systems · paying fast “to make it stop” before professionals engage · staff speculation reaching clients before your statement does · skipping the insurer call, then learning the policy’s notice clause the hard way · and the quiet one — never doing the post-incident review, so the phished password or unpatched gateway that started it all stays exactly where it was.

The bottom line

The first 72 hours of ransomware are a script that rewards having been written in advance: disconnect but don’t power off, protect the backups from your own haste, call insurer-first-then-everyone, log everything, communicate on schedule, and let the restore-or-negotiate decision be made by a full room with real numbers. Every item on that list is dramatically easier if the plan, the immutable copy, and the tested restore existed on the calm Tuesday before. That’s the actual lesson of hour zero — it’s decided in advance.