What are the steps after a ransomware attack, in order?

Roughly this order, adjusted to your situation. One: isolate affected machines from the network without switching them off, and stop the spread at the switches or firewall. Two: call your incident-response provider, the insurer's hotline and, if needed, a lawyer, and start an incident log. Three: secure evidence and check whether backups are intact and offline. Four: find out how the attackers got in, which systems they reached and whether data left, and assess reporting duties under NIS2NIS2: the EU's second Network and Information Security directive. The EU cybersecurity law (Directive (EU) 2022/2555) that sets security and incident-reporting duties for many companies. and the GDPRGDPR: General Data Protection Regulation. The EU data protection law (Regulation (EU) 2016/679)., with their deadlines. Five: decide what to tell staff, customers and partners. Six: remove the attacker, reset credentials and close the way in. Seven: rebuild and restore in priority order from clean backups. Eight: watch closely for weeks and hold a lessons-learned review. NetSenX helps at steps four and eight, with network evidence and continued detection.

← All 60 questions on Incident responseAll topics