What should a small business do in the first 24 hours of ransomware?
Key takeaways
- CERT-In directions require reporting a cyber incident to CERT-In or a law-enforcement incident report within 6 hours of being informed, with 180 days of logs retained.
- Isolate, do not power off: a running machine holds the ransom note, the running encryption process and the attacker's command history.
- Do not wipe and do not pay in the first 24 hours, because both destroy evidence and neither reliably ends the incident.
- Involve a forensics team before restoring, or you risk rebuilding onto an estate that is still compromised.
- In India, financial fraud connected to the incident should also be reported to cybercrime.gov.in and helpline 1930, and UPI disputes go to the bank first.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What should happen in the first hour?
Slow down, but act. Identify which machines are affected and which are not, and physically disconnect the affected ones from the network: unplug the network cable, disable Wi-Fi, and on mobile devices enable airplane mode. Do not power them off, because the ransom note, the process list and the attacker's command history are irreplaceable evidence. Photograph every ransom note and screen with a phone, and write down the exact time you first noticed it and the last time the systems were working normally. Pull the network cable on the router if you cannot tell which machines are involved. Then call two people: a forensics-capable responder and your bank, because fraud follows encryption quickly in Indian cases and the clock on a contested transaction is short.
What should happen in hours two to six?
Containment and reporting. Take an offline image of one affected machine if a responder can guide you; do not reimage yet. Disable or reset the credentials that were used on the affected machines, because stolen credentials are a second route in. Stop cloud sync clients and revoke active sync sessions on Google Drive, OneDrive and Dropbox, since a synced client will re-encrypt the cloud copy. And complete the CERT-In reporting obligation: the directions require that a cyber incident be logged to CERT-In or a law-enforcement incident report within 6 hours of being informed, with details of the incident, the impact, the mitigation and the recovery steps. Do not wait for certainty about what was taken; the report can be updated later.
What should happen in hours six to 24?
Evidence, backup decisions and communication. With a responder, determine what data was accessed rather than only what was encrypted, using logs from the last 180 days, which CERT-In's retention rule means most Indian businesses should already have. Decide on backups only after that scoping: check whether backups are intact, whether they were also encrypted or exfiltrated, and whether they are isolated from the same credentials. Publish one short holding statement to employees, customers and, if relevant, clients, stating what is known, what is being done and when the next update comes. Notify your insurer within the policy window, and notify your bank if payment data or banking access was in scope. Do not restore overnight without scoping.
Who should be told, and what should not be said?
Tell early and tell narrow. Employees first, because they are the people who will open a phishing mail next morning and because silence breeds rumour. Then customers whose data was in scope, because the DPDP Act 2023 and your own contracts will require notification, and the CERT-In 6-hour clock applies to the incident rather than to the public. Also your bank, your insurer and your auditor. What not to do: do not speculate publicly about the attacker, do not admit specifics you cannot yet substantiate, and do not send a message that promises a restore date you have not verified. Keep a single incident log with timestamps, decisions and names, because it becomes the report you will write later and the evidence you will need for the bank and the insurer.
| Window | Action | Why it matters |
|---|---|---|
| Hour 0-1 | Isolate devices, keep them powered on, photograph notes | Evidence is destroyed by a wipe or shutdown |
| Hour 1-3 | Call a forensics responder and your bank, stop cloud sync clients | Sync clients re-encrypt the cloud copy |
| Hour 3-6 | Complete CERT-In incident log within the 6-hour deadline | Statutory reporting obligation under CERT-In directions |
| Hour 6-12 | Scope what was accessed, check backup integrity, reset used credentials | Restoring before scoping rebuilds a compromised estate |
| Hour 12-24 | Holding statement, insurer and customer notification, single incident log | Notification duties and evidence trail start here |
What are the frequently asked questions?
Get a straight answer on this
Call our 24-hour ransomware response line now, and we will stay on the phone with you through the containment and CERT-In report.
Send us the details See pricing