TOOLBOX · DOWNLOAD
Ransomware: the first hours.
When ransomware strikes, the first hours determine whether the damage can be contained, traces are preserved, and reporting deadlines are met. This guide organizes the immediate measures by first hour, first day, and first week: isolate systems, secure evidence, renew credentials, decide on the ransom, report under the NISG 2026 (Austrian Network and Information Systems Security Act 2026) and the GDPR, file a criminal complaint, and restart from clean backups. It is based on the Response Checklist of CISA, MS-ISAC, NSA, and FBI, the BSI working paper on first aid for serious IT security incidents, and the guidance of the Austrian Federal Criminal Police Office (Bundeskriminalamt).
Free PDF · Guide
Ransomware Attack: First Aid for the First Hours
- Topic
- Backup & Emergency
- Format
- PDF, A4
- Length
- 10 pages
- Size
- 134 KB
- Updated
- Oct 25, 2026
- Sources
- 12
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Immediate measures for the first hour, the first day, and the first week, with reporting obligations under the NISG 2026 and the GDPR and a list of what you should avoid.
- Executive management of small and medium-sized companies in Austria who have to make decisions in an emergency
- IT management and administrators who isolate systems, secure traces, and plan the recovery
- Those responsible for emergencies, data protection, and information security who prepare the notifications
10 SECTIONS
What Is
Inside.
- 01
The first hours at a glance
What to do in the first hour, on the first day, in the first week, and afterward.
- 02
How to recognize an attack
Warning signs for all employees and traces that administrators should look for.
- 03
Isolate without destroying traces
The first hour to check off: disconnect from the network instead of shutting down, coordinated and over an independent channel.
- 04
Secure evidence
What the analysis, the insurer, and the criminal complaint need and how you secure it without altering it.
- 05
Block access, renew passwords
Close attacker access, review accounts, and renew credentials from clean devices.
- 06
Ransom and decryption
What the authorities say about paying, what to clarify before a decision, and where to find free decryption tools.
- 07
Reporting: obligations, criminal complaint, insurance
NISG 2026 for entities subject to it, GDPR for personal data, criminal complaint to the police, and contractual obligations.
- 08
Recovery from clean backups
Prioritize, rebuild cleanly, protect backups, and declare the incident over only according to defined criteria.
- 09
What you should not do
Typical mistakes in the first hours that increase the damage, destroy traces, or jeopardize the recovery.
- 10
Follow up and record emergency contacts
Learn lessons from the incident and enter the contacts you need immediately in an emergency.
EXCERPT
The first hours at a glance
- First hour
Contain
Disconnect affected systems from the network, do not shut them down. Do not sign in with administrator accounts on infected devices. Record the time you became aware, alert the emergency team by phone.
- First day
Situation picture and notifications
Set up a crisis team, secure traces, record the damage, inform the insurer, file a criminal complaint. Entities subject to NIS2 send the early warning no later than 24 hours after becoming aware.
- First week
Clean up and restart
Notifications within 72 hours to the CSIRT and the Austrian Data Protection Authority (Datenschutzbehörde). Find the point of entry, renew credentials from clean devices, rebuild systems, and restore them from clean backups by priority.
- Afterward
Close out
NIS2 final report no later than one month after the notification, debriefing, measures. In the case of full compromise, the BSI cites 2 to 4 weeks of downtime as a typical value.
The timeline is a TOMORIS recommendation based on the sources cited. CISA, MS-ISAC, NSA, and FBI recommend working through the first three steps in order: isolate, power down only if necessary, triage for recovery (Part 2, steps 1 to 3). Only the reporting deadlines are required by law (section 07).
SOURCES
Supported
by Sources.
- CISA, MS-ISAC, NSA, FBI: #StopRansomware Guide, Version 3.0 (October 2023) (opens in a new tab)Part 1 (preparation), Part 2 Response Checklist, steps 1 to 20, boxes on ransom and investigator information, Table 1
- BSI: First aid for a serious IT security incident, working paper version 1.2 (October 7, 2022) (opens in a new tab)Summary, chapters 3.2 to 3.10, 4.1 to 4.4, 4.9, 5, annexes 6.1, 6.5, and 6.6
- Federal Criminal Police Office: Ransomware – information for companies in Austria (information sheet, August 2026) (opens in a new tab)Description, warning signs, immediate measures, note on ransom
- Federal Criminal Police Office: Ransomware prevention page (opens in a new tab)Warning signs and section "What if it has happened?", as of August 18, 2026
- Federal Criminal Police Office: Cybercrime Competence Center C4 and reporting office against cybercrime (opens in a new tab)Cybercrime Reporting Office and criminal complaints, as of August 27, 2026
- No More Ransom: decryption tools (opens in a new tab)Note before use, recommendation on ransom; sponsors according to the "About the project" page
- NISG 2026, BGBl. I No. 94/2025, current version in the RIS (opens in a new tab)§§ 34, 35, 37, and 51, version as of October 25, 2026
- NISV 2026, BGBl. II No. 290/2026, authentic promulgation in the RIS (opens in a new tab)§ 5 para. 1 nos. 5 and 9, accessed October 25, 2026
- Federal Office for Cybersecurity: explanatory notes on the NISV 2026 (PDF) (opens in a new tab)On § 5: applies to sectors outside Implementing Regulation (EU) 2024/2690
- Regulation (EU) 2016/679 (GDPR) (opens in a new tab)Art. 4(12), Art. 33, and Art. 34
- Datenschutzgesetz (DSG, Austrian Data Protection Act), current version in the RIS (opens in a new tab)§ 18 para. 1, Data Protection Authority as supervisory authority
- European Commission: proposal for a Digital Omnibus Regulation, COM(2025) 837 of November 19, 2025 (opens in a new tab)Revision of Art. 33(1) GDPR; procedure 2025/0360(COD), open on October 25, 2026, according to the Legislative Observatory
This guide provides an overview of immediate measures and replaces neither an emergency plan nor legal advice or forensic support. The statutory text in its current version is authoritative; whether a reporting obligation exists depends on your entity and the incident. The contact list must be adapted to your company.
TOOLBOX
Explore
Further.
- Kostenlos
NIS2 applicability check (German)
Am I affected? In 3 minutes
Check Now 3-2-1-1-0 backup checklist
Data backup with an offline copy and tested restoration to check off, backed by BSI and CISA.
Learn MoreNIS2 reporting obligations
Deadlines, contents, and recipients of notifications under the NISG 2026, with a preparation checklist.
Learn MoreRansomware in the glossary
How ransomware attacks unfold and what double extortion means, briefly explained.
Learn More
BACKUP & EMERGENCY
More on
This Topic.
- PDF
Backup Checklist 3-2-1-1-0
Three copies, two media, one off-site, one offline, zero errors in the recovery test: a data backup checklist, backed by BSI and CISA.
View - PDF
IT Emergency Manual
Crisis team, contact list, classification as disruption, emergency or crisis, immediate measures and recovery with RTO and RPO: a fillable outline based on BSI Standard 200-4.
View - PDF
Incident Response Playbook
Who does what when a security incident occurs? Phases, roles, decisions with criteria and a fill-in incident log, based on NIST SP 800-61r3, BSI DER.2.1 and the NISG 2026.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.