Incident Response — Ransomware

STOP — next 30 minutes

Do these five things in this order. Do not improvise.

1. Take a phone photo of the ransom screen. Capture the ransomware family name, BTC wallet address, deadline countdown, and any onion/contact URLs. You need this for family identification, law enforcement reporting, and insurance.
2. Disconnect from the network. Pull the ethernet cable and disable WiFi. DO NOT power off the machine. Memory artifacts (encryption keys, process state) can survive in RAM and are critical for forensics — a shutdown destroys them.
3. Isolate every other machine on the same LAN. Assume lateral movement. Unplug or air-gap the back-office laptop, the second POS terminal, the receipt printer’s host, the router-attached NAS. The malware may already be staged on neighbors.
4. Call your cyber insurance carrier’s 24/7 hotline if you have one — BEFORE engaging with attackers. Carriers almost always require you to use their approved incident response firm; doing your own thing first can void the policy.
5. Do NOT pay yet. Preserve the encrypted disk. Decryption keys for many families have been released months later when law enforcement seized the C2 infrastructure. A preserved disk image gives you that option; an overwritten one does not.

You have 50 minutes until you open. That is not enough time to fully recover. The realistic 8 AM outcome is: doors open, POS is offline, you take cash only, and you communicate with customers honestly. Anything beyond that is a bonus.

Pay or don’t pay

The FBI’s stated position: the FBI does not recommend paying a ransom. Paying funds the ecosystem, marks you as a payer (you will be targeted again), and provides no guarantee of a working decryptor. The FBI also explicitly acknowledges that businesses face the decision and asks that — whatever you decide — you report the incident.

Run the math before you decide.

Cost of NOT paying:

• Downtime: revenue lost per day the cafe operates degraded or closed.
• Rebuild labor: 20–60 hours of IT time to image, wipe, reinstall, restore.
• Customer DB loss: 8,000 emails — marketing list value, plus the customer-relationship cost of telling them you lost their data.
• Breach notification (you owe this whether or not you pay — see below).

Cost of paying:

• The ransom itself (0.05 BTC ≈ thousands of USD at 2026 rates).
• ~60–70% historical chance of receiving a working decryptor. Even when it works, decryption is slow (hours to days for a typical small business dataset) and frequently corrupts a percentage of files.
• You still owe the breach notification — payment does not erase the disclosure obligation.
• You may still get extorted again. Many operators re-extort the same victim (“pay again or we leak the data we already exfiltrated”).
• OFAC sanctions exposure (see below).

OFAC sanctions — paying can be a federal crime

The US Treasury’s Office of Foreign Assets Control (OFAC) has designated specific ransomware groups as Specially Designated Nationals. Paying a sanctioned entity — directly or via an intermediary, regardless of intent or knowledge — is a violation of US sanctions law and carries strict-liability civil penalties plus potential criminal exposure.

Sanctioned or sanctions-adjacent groups have included (over time): Conti, Evil Corp, LockBit affiliates, North Korean state actors (Lazarus / APT38), and others. The list changes.

Before any payment is even discussed:

• Check OFAC’s recent actions: https://ofac.treasury.gov/recent-actions
• Your incident response firm, insurance carrier, and outside counsel must run sanctions clearance.
• Most reputable ransomware-negotiation firms refuse to facilitate payment to listed groups.

Check NoMoreRansom.org first

Before anyone discusses payment, identify the ransomware family and check for a free decryptor.

• https://www.nomoreransom.org/ — joint project of Europol, the Dutch National Police, Kaspersky, and McAfee. Free decryptors for ~150+ ransomware families.
• Use the “Crypto Sheriff” tool: upload the ransom note and one encrypted file. It matches the family.
• If a decryptor exists for your family: you do not pay. Download the tool, run it on a copy of the encrypted data, recover.

Family identification clues from the ransom screen:

• File extension appended to encrypted files (e.g., .locky, .lockbit, .babuk).
• Ransom note filename and wording.
• Wallpaper / lock screen branding.
• BTC address — sometimes reused, sometimes searchable in threat-intel feeds.

ID Ransomware (https://id-ransomware.malwarehunterteam.com/) is a second free identification service.

Preserve evidence

Before you reinstall anything, image the encrypted disk. This is the single most important decision you will make in the first hour. It costs you nothing, takes ~1–3 hours unattended, and preserves every future option (free decryptor release, law enforcement key seizure, insurance forensics requirement).

How to image:

• Pull the drive, connect it via USB write-blocker (or read-only adapter) to a clean machine.
• dd if=/dev/sdX of=/path/to/external/ransomware-image.dd bs=4M status=progress conv=noerror,sync
• Or use FTK Imager (free, Windows GUI) — produces .E01 forensic format with hashes.
• Verify the image hash (sha256sum) and write it down.

What to preserve, offline, on external media:

• The forensic disk image.
• A copy of the ransom note file(s).
• The phone photo of the ransom screen.
• Any system logs you can pull (Windows Event Log, application logs, AV logs).
• Network logs from the router/firewall if you have them.
• A written timeline: when you first noticed, what you did, who you called.

Label the external drive, lock it somewhere, and do not connect it to a production machine again.

Business obligations (NOT optional)

These apply regardless of whether you pay the ransom. Customer email loss alone almost certainly triggers state breach notification.

Obligation	When	Authority
State data-breach notification	All 50 states + DC have laws; typical 30–60 day window from discovery	State AG — notify in every state where affected customers reside, not just the state where you operate
PCI-DSS card-data incident	Within 24 hours to your acquiring bank if the POS handled card data	Acquiring bank + card brands (Visa Account Data Compromise, Mastercard ADC programs)
Cyber insurance	Within hours per policy terms (most policies require notice within 24–72 hours)	Carrier 24/7 hotline
HHS HIPAA (if any health data)	60 days from discovery	HHS Office for Civil Rights (OCR)
GLBA (financial services)	Promptly per the Safeguards Rule	FTC + your functional regulator
Payment processor (Stripe, Square, Toast, Clover, etc.)	ASAP	Your processor’s risk / trust & safety team
Employee notification	ASAP if employee credentials, payroll, or HR data may be exposed	—
SEC (if a public company)	Within 4 business days of materiality determination	Form 8-K Item 1.05

For an 8,000-email customer database: state breach notification almost certainly applies. The exact threshold varies (some states cover any unauthorized acquisition of personal info; some have name + one additional identifier triggers). Engage outside counsel today — not next week.

If the POS processed payment cards, PCI-DSS notification to your acquiring bank within 24 hours is non-negotiable. Failure to notify is itself a fineable event independent of the breach.

Recovery path

Do not skip steps. Do not reorder. Do not reuse anything from the compromised machine.

1. Image the disk (forensic copy — see “Preserve evidence” above).
2. Build a new clean machine from official vendor install media. Download from the vendor directly, verify the SHA-256 checksum against the vendor’s published hash. Do not reuse the old machine’s installer, USB stick, or recovery partition.
3. Restore data only from offline/immutable backups that predate the infection. Online backups (anything the compromised machine could write to during the infection window) must be assumed encrypted or tampered with. Restore to a staging area first; scan before promoting.
4. Rotate every credential that touched the old machine. POS admin password, POS vendor cloud account, email accounts, every SaaS service (accounting, scheduling, marketing, social), payment processor login, online banking, employee accounts, WiFi pre-shared keys, router admin. Assume everything that was typed on or stored by the old machine is in the attacker’s hands.
5. Re-deploy applications fresh. Install POS software, accounting software, etc. from clean vendor downloads. Do not restore application binaries or configuration directories from the compromised system — restore only data files (CSVs, exported DBs) after inspection.
6. Bring services online in stages, with monitoring. POS first (you need to operate), then secondary systems. Watch logs and outbound network traffic for anomalies for at least 30 days.
7. Watch for second-stage payloads. Many operators deploy multiple tools (Cobalt Strike, persistence beacons, info stealers) before triggering encryption. Assume the attacker — not just the ransomware binary — had hands-on access. Hunt for backdoors.

Double extortion — assume data was exfiltrated

By 2026, the majority of financially motivated ransomware operators exfiltrate data before triggering encryption. The encryption is leverage; the stolen data is insurance against you having good backups.

Implications for your 8,000-customer email database:

• The data is gone whether or not you pay. Payment may delay public leak; it does not retrieve copies.
• Many groups publish stolen data on dedicated leak sites (“name-and-shame” portals on Tor) weeks to months after the incident, even when the victim paid.
• Some groups sell the data wholesale to other criminals regardless of payment status.
• Plan for breach disclosure regardless of the pay/no-pay decision. The disclosure clock has started.
• Monitor known ransomware leak sites and threat-intel feeds (or pay an IR firm to do it) for mentions of your business in the weeks following the incident.

Reporting

Scenario	First call	Secondary	Legal / regulatory
Business ransomware	FBI IC3 (https://ic3.gov) + local FBI Field Office	CISA (https://stopransomware.gov)	State AG; PCI acquiring bank; cyber insurance carrier
Critical infrastructure	CISA + FBI Field Office	Sector-specific ISAC	CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) — 72-hour reporting window
Personal / individual ransomware	FBI IC3	NoMoreRansom.org	FTC if also tied to identity theft or financial fraud
Healthcare data involved	HHS Office for Civil Rights (60-day window)	State AG	HIPAA Breach Notification Rule

Reporting to FBI / CISA does not trigger an audit of your business. It does feed intelligence that has, in past cases, led to C2 seizures and free decryptor releases (Hive, REvil, others). Report even if you also pay.

What does not help (common wrong moves)

Things that feel productive but make recovery worse

• Running antivirus to “remove” the ransomware after encryption. AV may delete the encryptor binary, but the files are already encrypted. Removing the binary can also destroy artifacts a forensic firm needs to identify the strain. Image first, clean later.
• Reinstalling the OS without imaging the disk first. This is the single most common irreversible mistake. You destroy the only chance at future decryption when keys leak.
• Paying without checking OFAC sanctions and NoMoreRansom. May be a federal crime; may be unnecessary if a free decryptor exists.
• Restoring from a backup that was online during the infection. If the backup destination was mounted, mapped, or network-reachable from the infected host, treat it as also compromised. Validate the backup on an isolated machine before relying on it.
• Negotiating with the attacker yourself. They are professionals; you are stressed and uninsured-equivalent. Use a vetted negotiation firm (your insurer’s panel firm if you have insurance).
• Telling staff to “just keep quiet about it.” Employee creds may be exposed; they need to rotate passwords and watch for phishing. Quiet incidents become public the hard way.
• Posting about it on social media before counsel and insurer are looped in. Public statements before facts are clear create regulatory and litigation problems.

Pivot to

• Incident response — general — overall IR framework, not ransomware-specific.
• Threats — malware — how ransomware gets in, prevention upstream of an incident.
• Secure after compromise — long-tail hardening once the immediate fire is out: backup architecture, EDR, network segmentation, the playbook so this does not happen twice.

External resources

• NoMoreRansom.org — free decryptor lookup: https://www.nomoreransom.org/
• FBI IC3 — Internet Crime Complaint Center: https://www.ic3.gov/
• CISA StopRansomware — federal coordination hub, guides, alerts: https://www.stopransomware.gov/
• OFAC recent actions — sanctioned-entity check before any payment: https://ofac.treasury.gov/recent-actions
• ID Ransomware — second-opinion family identification: https://id-ransomware.malwarehunterteam.com/
• CISA Ransomware Guide — pre-incident and incident playbooks: https://www.cisa.gov/stopransomware/ransomware-guide