Most business owners think of ransomware as a distant risk until it happens to them. Understanding what actually unfolds in the first 72 hours after an attack shapes every preparation decision you should make today.
You arrive at the office on a Tuesday morning. Your staff are already there, but no one is working. Screens across the office show the same message — a black background, white text, a demand for Bitcoin, and a countdown timer. Your files are encrypted. Your accounting system won't open. Your server is locked. The timer says 72 hours.
Hour 1–4: Containment
The first priority is stopping the spread. If the ransomware is still running — still encrypting files on network shares, cloud sync drives, and connected devices — every minute counts. Disconnect affected machines from the network immediately. Disable Wi-Fi. Unplug ethernet cables. This feels drastic. It's correct. A ransomware infection that has encrypted one server is a very different recovery task from one that has spread to every endpoint and every network share.
Do not shut down infected machines before taking forensic images if at all possible. Volatile memory (RAM) may contain encryption keys that allow recovery without paying ransom. Your IT team or incident response provider needs to capture this before power is lost.
Contact your IT provider. If you don't have one, contact a cyber incident response firm. This is not the moment to try DIY remediation — ransomware recovery involves forensics, clean system rebuilding, and data restoration that requires specialist skills.
Hour 4–24: Assessment
Once spread is contained, the assessment phase begins: What was encrypted? What was the entry point? Are backups intact? What data was exfiltrated before encryption (modern ransomware groups steal data before encrypting it — so they can threaten to publish it even if you restore from backup)?
The answers to these questions determine your recovery path. If you have clean, tested, immutable backups that aren't connected to the compromised network, recovery is a multi-day project. If your backups were also encrypted, you're facing a choice between paying a ransom (with no guarantee of key delivery) or rebuilding from scratch.
Notify your cyber insurer if you have coverage. They have preferred incident response providers and specific notification windows — missing the notification deadline can affect your claim.
Hour 24–72: Notification and Recovery
If personal data was accessed or exfiltrated, the NZ Privacy Act 2020 requires you to notify the Privacy Commissioner and affected individuals if the breach is likely to cause serious harm. Legal advice on this notification obligation should be sought early — the notification threshold has consequences in both directions (notifying unnecessarily and failing to notify when required).
Recovery begins with clean infrastructure. Rebuilding on top of a compromised environment risks re-infection. Every system needs to be verified clean before business data is restored to it. This process takes days to weeks depending on the scale of the environment.
The Decisions You Make Today Determine How This Goes
The difference between a ransomware event that takes three days to recover from and one that costs six figures and takes three months is entirely determined by decisions made before the attack: Are backups immutable and tested? Does EDR catch and kill ransomware before it spreads? Is the network segmented so one compromised endpoint can't encrypt the entire business? Do staff know to report suspicious activity immediately?
Optimyze deploys immutable cloud backups, SentinelOne EDR, and monitored network access for every managed IT client. These are the controls that change how this scenario ends.
The worst time to plan for ransomware is after it's happened. The three questions to answer today: Where are our backups? Are they tested? Are they offline?
