SQUAREWAVE_OS · v.2026 · Orlando FL
SQUAREWAVETECHNOLOGIES
Managed I.T. that picks up the phone. Drag icons to rearrange. Click to open.
Managed I.T. that picks up the phone. Drag icons to rearrange. Click to open.
March 18, 2026 · #security #ransomware #incident-response
What to do in the first 60 minutes of a suspected ransomware incident. The choices you make in that hour set the ceiling on the rest of the response.
Every business owner we have talked to who has been through a ransomware incident says the same thing afterward. They wish they had known what to do in the first hour. This is the short version. If your MSP is worth what you pay them, they already know this. If they don't, you have a bigger problem than the ransomware.
Pull affected systems from the network. Physically unplug the ethernet, disable the wireless, whatever it takes. The point is to stop the spread. This is the single most important thing you can do in the first ten minutes, and it costs nothing.
Do not power off. Do not delete files. Do not try to "clean it up." Everything you touch is evidence, and everything you touch may be the only forensic trail your incident-response team has to figure out how the attacker got in. If you don't know, don't do.
Call your MSP first. Your cyber-insurance carrier second. Your legal counsel third. Not your board, not the client, not the news. Insurance carriers have preferred forensics vendors they require you to use. Calling insurance out of order can void the policy. That is the actual math.
Not without your cyber-insurance carrier's written authorization. Paying can void the policy, can be a federal offense if the attacker is a sanctioned entity, and offers no guarantee of recovery. The full playbook we hand clients is longer than this and lives in the Whitepapers folder.