Learning Ransomware Response & Recovery

Chapter 9. The First 12 Hours

It’s 8 a.m. on a Thursday, and your phone starts blowing up with calls from people: “All my files are locked! My computer is locked! And my files aren’t working!” Moments later, a red skull flashes across your screen, demanding $500,000 in bitcoin. Your heart races, stomach sinks, eardrums begin pounding, the office erupts in chaos with employees panicking, and you’re left wondering if your backups are safe. This is the gut-punch reality of a ransomware attack, a high-stakes marathon where every decision feels like it could save or sink the organization, and your job.

No playbook, not even the IRT framework you put together from Chapter 7, fully prepares you for the fog of war you’ve become immersed in. The miscommunications, ethical dilemmas, and surprises that test your fortitude and that neatly organized IRP. The plan where you prioritized critical systems, strategized on directions for isolating the infection, and communicated clearly. But in the heat of the attack, you’re battling incomplete or outdated information, emotional overload, and a ticking clock. This chapter pushes you into the heart of a ransomware response, hour by hour, decision by decision, when you really feel the fog of war. Through real-world stories, practical lessons, and interactive exercises, you’ll feel the chaos, learn to navigate tough calls, and discover how to keep you and your team afloat (Mike’s PTSD got worked up just writing this intro).

Join with others dealing ...