The First 24 Hours of Ransomware: Actionable Wins for This Week

When business owners picture a ransomware attack, they often imagine complex computer code scrolling across dark screens. In reality, the first twenty-four hours of a ransomware incident look very different. They are chaotic, stressful, and dominated by hard business decisions rather than technical wizardry.

At Orange Penguin, we have supported Scottish businesses since 2007. Over the years, we have seen how quickly a normal working day can derail when files suddenly lock, ransom notes appear, and phone lines start ringing. Whether you run a manufacturing firm in Dundee, a distribution hub in Perth, or a professional services office in Edinburgh or Glasgow, understanding the timeline of an attack is the best way to prevent total operational shutdown.

Here is what genuinely happens in those critical first twenty-four hours, alongside five practical quick wins your business can action this week to stay protected.

The Anatomy of the First 24 Hours

### Hours 0 to 2: Discovery and Containment The crisis usually begins quietly. A member of staff notices they cannot open a spreadsheet on the shared drive, or a strange text file appears on their desktop. Within minutes, other users report the same issue.

Once management realises this is not a routine glitch, the immediate priority is containment. In the old days, people simply pulled power cables out of the wall. Today, cutting power can destroy volatile memory that forensic experts need to identify the entry point. Instead, the focus is on severing network connections. Ethernet cables are unplugged, Wi-Fi is switched off, and remote access links are severed to stop the ransomware spreading to other servers across Angus, Fife, or remote home workers.

### Hours 2 to 6: Assessment and Forensics Once the network is isolated, IT specialists must establish what variant of ransomware is involved and how far it has spread. They inspect firewalls, server logs, and endpoint security tools.

During this window, two critical questions must be answered: - Did the attackers merely encrypt files, or did they extract sensitive data before locking the systems? - Are the backup repositories clean, or did the attackers compromise them before deploying the payload?

### Hours 6 to 12: The Recovery Strategy By early afternoon, leadership must make key operational decisions. If backups are intact and air-gapped, recovery can begin. If backups are infected, unverified, or non-existent, the business faces an existential dilemma.

Paying a ransom is never recommended by security authorities or police. There is no guarantee you will receive a working decryption key, and paying marks your firm as an easy target for future extortion. A clean restoration from verified backups is the only dependable route back to normal trading.

### Hours 12 to 24: Legal Duties and Communication Under UK GDPR, organisations must report personal data breaches to the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, where there is a risk to individuals' rights and freedoms. The first day requires gathering enough accurate facts to determine your legal obligations without causing public panic.

Staff need clear instructions on how to work without IT systems, suppliers must be informed if deliveries will stall, and customers must be handled with care.

Five Quick Wins You Can Action This Week

You do not need a multi-million-pound security budget to dramatically cut your recovery time. Here are five practical wins you can implement over the next few days.

### 1. Print an Offline Emergency Incident Plan When your network is encrypted, you cannot open the incident response plan saved in your OneDrive folder. You also cannot check email or look up staff contact numbers in your central directory.

Take thirty minutes this week to write a simple, two-page document containing: - Primary and secondary mobile numbers for key directors and managers. - Out-of-hours phone numbers for your IT support provider and cyber insurance broker. - The direct contact details for your legal advisor.

Print three physical copies. Keep one in the office safe, give one to the managing director, and give one to your operations lead.

### 2. Test an "Air-Gapped" or Immutable Backup Modern ransomware deliberately targets backups first. If your backup drive is permanently mapped as a drive letter on your main server, ransomware will encrypt the backups just like any other folder.

Speak with your IT provider to confirm that you have an immutable or air-gapped backup tier. An immutable backup cannot be altered, overwritten, or deleted for a set period, even by someone with administrative privileges. This week, ask for proof of a successful test restore of a single folder and a full server image.

### 3. Separate Standard Accounts from Admin Accounts One of the most common ways ransomware spreads across an entire company is through compromised local administrator credentials. If an employee clicks a malicious link while logged in with admin rights, the malware immediately gains permission to install itself across system directories.

Audit your user accounts this week. Ensure that daily tasks, such as answering emails and browsing the web, are performed on standard user accounts. Administrator credentials should only be used when making specific system changes, and they must always be protected by multi-factor authentication (MFA).

### 4. Review Your UK GDPR 72-Hour Response Template Trying to draft a notification to the ICO in the middle of a cyber crisis is stressful and leads to mistakes. Download the official ICO reporting guidelines this week and draft a basic incident recording template.

Your template should track: - The exact date and time the incident was discovered. - What categories of personal data may have been accessed. - The approximate number of individuals affected. - The immediate containment steps taken.

Having this structure ready turns a frantic scramble into a calm, procedural task.

### 5. Run a 5-Minute "Report, Don't Panic" Staff Briefing Many cyber incidents worsen because an employee realises they clicked a suspicious attachment, feels embarrassed, and hopes nothing happens. By the time IT is alerted, hours have passed, and the malware has moved laterally across the network.

Remind your team that early reporting is rewarded, not punished. Instruct staff that if their computer behaves strangely or displays an unrecognised message, they should disconnect the network cable or switch off Wi-Fi immediately and call the IT helpdesk on their mobile phone.

Achieving Baseline Protection with Cyber Essentials

If you want a clear benchmark for your security, working towards Cyber Essentials is an effective next step. This UK government-backed standard focuses on five technical controls: firewalls, secure configuration, user access control, malware protection, and security update management.

Research consistently shows that implementing these five controls prevents the vast majority of commodity cyber attacks. Furthermore, achieving certification demonstrates to clients and supply chain partners across Scotland that you take data protection seriously.

The Orange Penguin Take

At Orange Penguin, we believe effective cybersecurity is practical, not paranoid. Over our years serving businesses in Dundee, Perth, Fife, and right across the Central Belt, we have seen that preparation beats panic every single time.

The first 24 hours of a ransomware incident are always difficult, but they do not have to be fatal to your business. When you have immutable backups, tested recovery plans, and trained staff who know how to respond, an attack becomes an operational hurdle rather than a permanent closure.

If you are unsure how your current systems would hold up during those critical first twenty-four hours, we can help.

Book a free, no-obligation IT health check with the Orange Penguin team today. We will review your backups, examine your access controls, and give you honest, plain-English advice on keeping your business resilient.