Ransomware: The Playbook Before, During and After an Attack

Before: the preparation that makes attacks survivable

Most ransomware gets in through phishing, exposed remote access, or unpatched software. The preparation that matters: multi-factor authentication everywhere, patching on a schedule, email security that filters the obvious attacks, and - the most important control of all - backups that are immutable, offline or otherwise untouchable by attackers, and tested by actually restoring.

Add a written incident plan so people know their roles before adrenaline takes over. Rehearse it once; it's the cheapest insurance you'll buy.

During: contain without destroying evidence

The moment you suspect ransomware: disconnect affected systems from the network, disable remote access, and preserve evidence rather than cleaning up. Don't pay a ransom on impulse - it funds criminals, and paying is no guarantee of recovery. This is the moment to have your incident team (and insurer) on the line, not to improvise.

After: recover and understand

Restore from your tested backups - starting with critical systems - then re-secure before bringing anything back online. Assess what data was exposed: if personal information was involved, your Privacy Act 2020 notification obligations kick in. Finally, find the entry point and close it, or the next attack is just a repeat.

The honest truth about recovery

Organisations with tested, isolated backups recover in days. Organisations without them face data loss, weeks of downtime and the decision about whether to pay. The difference is decided long before the attack.