Ransomware response runbook (first 60 minutes)

Coveware's 2025 data shows that 78% of ransomware financial losses are determined by decisions made in the first hour. Organisations with rehearsed runbooks pay an average of €72,000 per incident; those without pay €410,000. This runbook is the script your IT lead reads when the call comes in at 03:00.

• Average dwell time before encryption: 5.5 days (so detection alone is not enough)
• Median ransom demand against EU SMEs in 2025: €380,000
• Average downtime for SMEs without runbook: 22 days
• Average downtime with rehearsed runbook: 4.5 days

The first quarter-hour is purely about stopping the spread. Do not investigate, do not negotiate, do not call the press team. Contain.

• Disconnect affected hosts from network (pull cable or disable NIC — do NOT shut down)
• Disable affected user accounts in AD/Entra ID
• Block ransomware C2 domains at firewall (use Bitdefender GravityZone IoC feed)
• Suspend all VPN sessions
• Isolate backup repositories — assume they are also targeted

Evidence preservation determines whether you can recover, prosecute, claim insurance, and meet GDPR Article 33. Skipping this step costs you all four.

• Take memory image of one affected host (FTK Imager, Magnet RAM Capture)
• Snapshot all affected VMs before any remediation
• Export full logs from EDR, firewall, AD, M365 — to immutable storage
• Photograph any ransom note and screen state
• Open formal incident ticket with timestamp of detection (this anchors GDPR/NIS2 clocks)

GDPR Article 33 requires notification within 72 hours of awareness. NIS2 Article 23 requires the early warning within 24 hours. Both clocks started at minute 0 — so you have less time than you think.

• Internal: CEO, DPO, legal counsel, communications lead
• External: cyber-insurance hotline (claim coverage triggers usually require notification within 24h)
• Regulators: prepare GDPR Art.33 draft and NIS2 Art.23 early warning (do not send yet — coordinate with counsel)
• Customers: prepare holding statement; do not send detail until impact assessed
• Law enforcement: in Spain INCIBE-CERT and Policía Nacional UCC; in France ANSSI; in NL NCSC-NL; in Germany BSI

Whether to negotiate is a board decision, not an IT one. But the IT lead must give the board the right inputs. Modern guidance from EU agencies and from the EU Council's 2024 Ransomware Recommendation is unambiguous.

• Sanctions risk: paying a sanctioned group (LockBit affiliates, REvil, certain DPRK groups) is a separate criminal offence
• Decryption success rate when paid: only 61% deliver working decryptor (Coveware 2025)
• Re-attack rate when paid: 31% suffer a second incident within 12 months
• Insurance coverage: most policies now require pre-approval before payment
• Public funding/grants: receipt may bar payment entirely (German BMI guidance)