Ransomware rarely arrives without warning signs, but when files start becoming unreadable the clock is already running. The first hour is about stopping the spread, keeping the evidence you will need, and getting the right people involved. Here is a practical checklist.
1. Confirm and escalate
- Confirm what you are seeing: ransom notes, renamed or encrypted files, security tool alerts, unusual account activity.
- Escalate immediately to whoever owns incident decisions, normally the CISO or head of IT, and to executive management.
- Open a simple incident log: what was noticed, when, by whom, and every action taken from now on.
2. Contain without destroying evidence
- Isolate affected machines from the network (unplug the cable or disable Wi-Fi) but leave them powered on. Memory and disk evidence is lost when machines are shut down or reimaged.
- Disable or reset compromised accounts, starting with administrator and service accounts, from a device you trust.
- Check that backups are intact and disconnect them from the network so they cannot be encrypted too.
- Preserve logs from firewalls, servers, email and security tools, and pause automatic log rotation.
3. What not to do
- Do not wipe and rebuild systems before the scope of the attack is understood. You may restore the attacker's access along with your data.
- Do not contact the attackers or pay a ransom before taking specialist and legal advice.
- Do not discuss the incident on email or chat systems that may be compromised; use phones or a separate channel.
4. Reporting obligations
If personal data may have been affected and there is a real risk of harm to the people concerned, Kenya's Data Protection Act, 2019 requires the data controller to notify the Data Protection Commissioner within 72 hours of becoming aware of the breach, and sector regulators have their own expectations. Start that assessment early rather than at hour 71. Our Data Protection Act guide summarizes the main duties.
5. After the first hour
Once the spread is contained, the work moves to investigation (how did they get in, what did they touch), eradication and a careful, staged recovery. Organizations with continuous monitoring usually catch the warning signs, such as unusual logins or mass file changes, well before encryption starts. That is the case for detection and response technology such as SIEM and XDR.
Facing an incident right now? Call our team.