Ransomware: the first 72 hours checklist

The first hours after a ransomware attack shape the whole claim. What you do, who you call and what you promise can decide how much the policy pays.

Many policies set short windows. Some cover emergency response costs only in the first 48 or 72 hours, and often only when you use the insurer's approved panel providers. Most require the insurer's written consent before you pay or promise a ransom. These rules vary by policy, so read your own wording now, before you need it. Our guide to ransomware and cyber insurance covers what to look for.

Hours 0 to 4: contain and call

• Isolate affected devices from the networkUnplug the network cable or turn off Wi-Fi, and leave the devices powered on. Switching off can destroy evidence held in memory.
• Call the insurer's incident response line firstOn many policies, a call to the response line counts as notice. A call to your broker alone may fall short, so check your wording.
• Use the insurer's panel providersMany policies pay early emergency costs only when you use approved panel firms. Bringing in your own firm without consent can leave the bill with you.
• Write down when and how you found the attackThe time of discovery often starts the policy clocks. Note who found it, what they saw and who they told.
• Tell your directors and senior managersTheir awareness often starts your duty to notify. Bring them in early so decisions have an owner.

Hours 4 to 24: protect evidence and your position

• Preserve logs, ransom notes and affected systemsInsurers need evidence to find the cause and size the loss. Photograph screens and keep a copy of the ransom note.
• Leave all contact with the attackers to specialistsThe response team the insurer appoints handles any contact. Early messages from you can raise the demand or give away too much.
• Get written consent before paying or promising a ransomMost policies require the insurer's prior written agreement. A payment may also breach sanctions law, which the specialists will check.
• Share facts with customers and leave blame for laterMany policies forbid admitting liability or settling without consent. Keep early messages to what you know.
• Reset passwords from a clean deviceAttackers often hold stolen passwords. Start with admin, email and backup accounts, guided by the forensic team.
• Keep a timeline of every decisionNote the time, the action and who approved it. This record supports the claim and answers regulator questions later.

Hours 24 to 48: assess and report

• Report the attack to law enforcementMany policies require a police report for ransomware and extortion. Keep the reference number for the claim file.
• Find out whether personal data was takenData protection law can set its own deadline, such as 72 hours under GDPR and UK GDPR for telling the regulator. Ask the breach lawyer what applies to you.
• Agree the method before notifying affected peopleSome policies pay for notification letters only when the insurer approved the method first. Check your wording before any letters go out.
• Check backups are clean before you restoreConfirm the attacker is out and the backup copy is free of malware. Restoring too early can bring the infection back.

Hours 48 to 72: recover and record the loss

• Get written consent for costs after the emergency windowOnce the first hours pass, many policies need approval for every cost. Ask before you sign any new supplier.
• Start tracking lost income and extra costsBusiness interruption claims need figures, such as invoices, sales projections, payroll and accounts. Begin the record now while the facts are fresh.
• Agree what you will tell customers and staffKeep messages short and factual. Clear the wording with the response team first.
• Keep every invoice and receipt in one folderThe claims team will ask how each cost arose. One incident folder keeps the answers in one place.

Broker's tip

Print one page with the response line number, your policy number and the phone numbers of your directors and IT provider. Keep copies outside your network, in a desk drawer and at home. During an attack, email and shared drives may be locked, and nobody will find a file stored on a system that will not start. Making that first call within the hour protects both the recovery and the claim.