Ransomware Recovery: What Should Your Business Do in the First 24 Hours?

"Ransomware recovery is not a race to restore files. It is a race to regain control."

Your files are encrypted. Staff cannot log in. A ransom note is on the screen. What should you do first?

In the first 60 minutes, the answer is not to restore. It is: isolate affected devices, assess the damage, contain the spread, preserve evidence, secure your backups, then recover and monitor.

A structured response is also part of effective business continuity services in London, helping organisations maintain critical operations while systems are investigated and restored.

The UK National Cyber Security Centre (NCSC) guidance for the first few hours centres on containing and assessing the damage, setting up governance and establishing clear communication lines. This guide covers the first 24 hours, then the safer route back to normal.

What Should Your Business Do During the First 24 Hours of a Ransomware Attack?

1. Isolate Affected Devices

Disconnect every visibly infected device from the network and isolate any compromised server. Do not wipe anything, and do not reconnect machines to test them. Containment comes first because ransomware spreads sideways. Network segmentation, which splits a network into separate zones, limits how far it can travel.

2. Activate Your Incident Response Team

Incident response is the planned process for handling a security breach. Name one incident owner to make decisions and control communications, then involve senior management, IT, legal advisers, your insurer and outside specialists. A QCom engineer can sit alongside your team from hour one and take containment tasks off their hands.

3. Establish What Has Been Compromised

Check endpoints, servers, cloud platforms, email accounts, administrator rights and your backups. Then ask whether data was only encrypted or also stolen. Double extortion means attackers steal data first and encrypt it second, so encryption alone does not prove theft. The Cyber Security Breaches Survey 2025/2026 found phishing reached 38% of UK businesses and ransomware 1%: a small share, but one that can halt a business outright.

4. Preserve Evidence Before Rebuilding

Keep system logs, security alerts, the ransom note, authentication records, firewall logs and timestamps. Rebuilding too early destroys the evidence investigators need to find the way in.

5. Protect Your Backups First

A backup that exists is not the same as a backup you can recover. Check that copies are offline or immutable (impossible to alter or delete once written), that backup credentials are separate, and that you know your last clean recovery point. Two numbers matter: RPO, how much data you can afford to lose, and RTO, how long you can afford to be down.

6. Should You Pay a Ransomware Demand?

Do not decide in a rush. The NCSC and UK law enforcement do not encourage payment, and decryption after payment can still take weeks without fixing the original weakness. Test whether backups give you a route back, ask whether sensitive data was stolen, take legal and insurance advice, and record how you decided. Can you recover without paying? Yes, if clean backups exist and you remove attacker access.

Need Expert Support After a Ransomware Attack?
From cybersecurity and IT support to business continuity and disaster recovery, QCom Ltd helps businesses strengthen their infrastructure and respond to technology risks. Explore our specialist services to find the right support for your organisation.
Strengthen Your Ransomware Readiness!

7. Build a Minimum Viable Operating Environment

Minimum viable operations (MVO) means the smallest set of systems that keeps the business running. NCSC guidance notes that organisations commonly operate with limited or no IT services for weeks, and full recovery can take many months. That is why business continuity services in London firms belong in the plan before an attack. Restore in this order:

Order	System
1	Identity and authentication
2	Core network
3	Critical applications
4	Data and file services
5	Communications and finance

8. Restore From a Verified Clean Backup

Find the last clean backup and validate its integrity.
Confirm the attacker no longer has access.
Reset privileged credentials and patch vulnerable systems.
Rebuild compromised devices.
Restore critical systems in sequence, then monitor.

Restoring too early can let the attacker back in and restart the incident.

9. Reset Credentials and Close the Way In

Restoring files does not remove attacker access. Reset administrator, privileged, VPN, cloud and service account passwords and enforce MFA. An IT security consultancy in London can trace stolen credentials and confirm the route is shut.

10. Check Your Legal and Notification Duties

Establish what information was affected, whether personal data was involved, whether it left the network, and which customers, suppliers, regulators or insurers must be told. Take specialist legal advice, because the answer depends on your circumstances.

11. Test the Plan Before the Next Incident

Run backup restore tests, tabletop ransomware exercises and timed RTO and RPO checks, and keep emergency contacts and supplier escalation routes current. Disaster recovery consulting turns those tests into a rehearsed plan with named owners.

12. Strengthen Your Business Afterwards

Add MFA, endpoint detection and response, network segmentation, patch management and 24/7 monitoring. Cyber security managed services can help keep these controls monitored and maintained over time. For businesses that also need to review their wider network infrastructure, Network Consultancy provides specialist support for network security, resilience and performance.

What Does Ransomware Recovery Mean for London and Birmingham Businesses?

London legal, financial and professional services firms hold client data they must protect, so they need IT consultancy services in London teams can use to map dependencies and recovery order. Birmingham manufacturers, property firms, and healthcare providers rely on suppliers and remote staff, so face-to-face support from a cyber security consultancy in Birmingham can help.

Why Choose Qcom Ltd?

QCom Ltd brings IT consultancy, cyber security, network design, business continuity and managed IT into one team, with a London presence and a Birmingham office in Edgbaston. That matters during an incident, because the engineers who design your network help you recover it. The IT consultancy services in London that clients commission from us range from broadcast networks to security accreditation, as below.

QCom Case Studies

BT Sport

Problem: An East London broadcast facility needed a secure network.
Solution: Network and security design using Cisco, Juniper and Fortinet, over 100 km of data cabling, and testing before go-live.
Result: Delivered on time and on budget, with a helpdesk supporting around 75 users.

Full case study: BT Sport case study →

HURLEY Secure IT Environment

Problem: A secure IT and communications environment with remote access.
Solution: Resilient network, server and telephony setup.
Result: Expanded to two further offices, at about 70% less than equivalent in-house support.

Full case study: Hurley case study →

W13 Cyber Security Assessment

Problem: Unknown security gaps.
Solution: Assessment, firewall and malware protection, patch management and staff training.
Result: Cyber Essentials accreditation.

Full case study: W13 case study →

See How QCom Ltd Helps Businesses Build Resilient IT!
From cyber security and network infrastructure to IT support and business continuity, see how QCom Ltd has helped organisations address complex technology challenges and strengthen their IT environments.
Explore Our Case Studies!

The First 24 Hours Are About Control

The first 24 hours after ransomware are about controlled decisions, not panic. Contain the attack, establish the scope, protect evidence, secure backups, set recovery priorities, remove attacker access, restore verified clean systems and strengthen resilience. That sequence is the core of business continuity services that London and Birmingham organisations need.

Is Your Business Ready for Its Next Cyber Security Challenge?
From ransomware recovery planning to cyber security, IT infrastructure and business continuity, QCom Ltd can help you identify gaps and strengthen your organisation's resilience. Speak with our team to discuss your current IT and security requirements.
Talk to QCom Ltd About Your IT Security Needs!

Frequently Asked Questions

1. What should a business do in the first hour after ransomware?

A. Isolate affected devices, name one incident owner, preserve logs and the ransom note, check backups are intact, and call outside specialists. Do not wipe systems or pay in haste.

2. Should you turn off computers during a ransomware attack?

A. Follow your incident response plan and take specialist advice, because the right move depends on your environment and the evidence needed. Disconnecting from the network preserves more evidence than wiping.

3. Are cloud backups safe from ransomware?

A. Not automatically. Stolen credentials can reach them, and the NCSC advises scanning backups for malware before restoring. Check isolation, immutability and access controls.

4. How long does ransomware recovery take?

A. The NCSC says full recovery from a highly disruptive attack can take many months, after weeks of limited IT. Tested backups and a clear restore order shorten it.

5. What is the difference between disaster recovery and ransomware recovery?

A. Disaster recovery is the broader framework for restoring operations after any outage. Ransomware recovery adds containment, investigation and removal of attacker access before systems return.