Incidents
Recovering after ransomware
What to do when systems are encrypted: contain, assess the scope, recover from reliable backups and rebuild an environment that will not fall the same way again.
The starting point
After an encryption event, the priority is restoring operations without reintroducing the problem. Restoring quickly onto the same compromised environment usually ends in a second incident days later.
What we usually find
- It is unclear which systems are affected and since when.
- Backups may be attached to the same compromised domain.
- Pressure to resume invoicing as soon as possible.
- Notification and record-keeping obligations.
Which companies it fits
Companies that have suffered an encryption event, or that want to define in advance how they would act if one occurred.
If you have an incident in progress, call our contact number; if you want to prepare, we will review backups and access.
Contact the technical teamWhat the solution includes
Containment
Isolating devices and cutting communications to stop propagation.
Scope assessment
Which systems and data are affected and which backups are reliable.
Orderly recovery
Server rebuild and restoration by business priority in a clean environment.
Subsequent hardening
Review of access, two-factor authentication, segmentation, immutable backups and continuous monitoring.
How it is deployed
- 1First response and containment.
- 2Inventory of damage and of available backups.
- 3Recovery plan in order of criticality.
- 4Restoration and validation with each area owner.
- 5Report and hardening plan to prevent a repeat.
Services involved
Frequently asked questions
- Is all data always recovered?
- That cannot be guaranteed. The outcome depends on the scope of the encryption and on the quality and age of the available backups.
- Do you recommend paying the ransom?
- No. Paying does not ensure recovery and funds criminal activity; the approach is to recover from reliable backups.
- Is there an obligation to notify?
- There may be, depending on the data and sector. That is a legal assessment for the company's legal adviser.
- How long before we can work again?
- It depends on volume, backup condition and the number of systems. Whatever sustains invoicing is prioritised.
Contact the technical team
If you have an incident in progress, call our contact number; if you want to prepare, we will review backups and access.
Contact the technical team