Ransomware Response Playbook 2026: The First 72 Hours That Decide Whether You Recover

Sophos State of Ransomware 2026 reports 63 percent of surveyed organisations were hit in the last 12 months. Average ransom demand climbed to 4.9M USD (median 1.5M USD). Average downtime is 21 days when paid, 24 days when not. 71 percent of attacks now include data exfiltration in addition to encryption; 34 percent add DDoS as a third extortion lever.

Attack chains have compressed. Median dwell time from initial access to encryption is now under 24 hours (was 5 days in 2022). This means your detection and response window is measured in hours, not days.

The single worst mistake is powering off endpoints. Volatile memory contains encryption keys, injected DLLs and process trees that forensics needs. Isolate at the network layer instead.

• Activate the IR plan and page the on-call security lead and CISO.
• Isolate affected endpoints via EDR network containment (CrowdStrike, SentinelOne, Defender for Endpoint all support one-click isolation).
• Disable AD accounts of any user seen in the initial access chain. Revoke Kerberos tickets and session tokens.
• Cut off backup infrastructure from production networks to prevent backup encryption or deletion.
• Preserve logs: SIEM, EDR, cloud audit, VPN, identity provider. Do not overwrite.
• Snapshot cloud VMs and databases before making any changes.

Once contained, the priority is understanding scope and starting mandatory notifications.

• Engage IR retainer (Mandiant, CrowdStrike Services, Kroll, Unit 42) if you have one. If not, engage now.
• Notify cyber insurance carrier within the timeframe your policy requires (usually 24 to 48 hours). Late notification voids coverage.
• Notify legal counsel (external breach counsel, not just in-house).
• Assess regulatory reporting obligations: GDPR (72 hours to supervisory authority), SEC Form 8-K (4 business days for material incidents, US listed), HIPAA (60 days), state breach notification laws, industry regulators (FCA, PRA, ASIC, DPDP).
• Set up a war room in a channel that is NOT on the compromised infrastructure. Use out-of-band communication (personal phones, Signal, dedicated laptops).
• Map affected data (customer PII, IP, source code, financial records) to prioritise notification and legal exposure.

By hour 24 you know roughly what is encrypted, what is exfiltrated, and how the attackers got in. Now decide the recovery strategy.

• Rebuild from backups if they are known clean. Validate backup integrity out of band; some ransomware families backdoor backup catalogs.
• Consider partial payment ONLY as a last resort with law enforcement and legal counsel guidance. In many jurisdictions (US OFAC sanctions list, UK NCSC guidance, Australia), payment to sanctioned groups is illegal.
• Coordinate stakeholder communications: employees, customers, regulators, media. Assume anything you say internally will leak.
• Prepare CEO / board briefing with facts, unknowns, and 24 to 48 hour outlook.
• Publish a customer-facing statement only after legal review. First statement should acknowledge, not detail. Update every 24 hours until resolution.

If your organisation decides to negotiate, use professional negotiators (Coveware, GroupSense, Kivu). Do not negotiate directly. Typical results: 40 to 60 percent reduction from initial demand, proof-of-decryption test file first, cryptocurrency payment (Bitcoin dominant, Monero increasing).

Payment does NOT guarantee decryption works cleanly. Sophos 2026 data: paying organisations recovered only 61 percent of encrypted data on average. Rebuilding from clean backups is the more reliable path when backups exist.

Recovery is not the end. Attackers who breached once often retain persistence or sell access to other groups. The 90 day hardening plan should include:

• Full identity reset: rotate all service account credentials, review privileged access, deploy phishing-resistant MFA (FIDO2 hardware keys for admins).
• Deploy or tighten EDR across every endpoint and server. Aim for coverage above 98 percent.
• Isolate backup infrastructure with air-gap or immutable storage (S3 Object Lock, Azure immutable blob storage).
• Implement network segmentation to limit blast radius of the next incident.
• Run a tabletop exercise with the executive team so they know their roles when the next incident happens.
• Debrief with your IR retainer and update the playbook. Real incidents surface gaps every tabletop misses.