For most SMEs a ransomware attack starts with a morning phone call: files will not open, screens show a ransom demand, accounting is unreachable. What happens in the following hours decides how long operations stand still and how much damage remains. This article describes a sequence that has proven itself. It does not replace an incident response plan but shows what belongs in one.
The first hour: contain, do not clean up
Disconnect affected devices and servers from the network by pulling cables or disabling Wi-Fi, but do not shut them down: memory holds traces important for analysis. Lock remote access, especially VPN and remote maintenance. Protect backups by disconnecting any still-connected backup targets. Delete nothing, reinstall nothing and open no files left by the attackers.
Hours one to four: understand the situation and get help
A named person takes the incident lead and keeps a timestamped log. The IT provider and, where needed, forensic specialists are brought in. Anyone with cyber insurance calls its emergency number before engaging their own providers, since many policies require it. In parallel, establish which systems are affected, whether data may have been exfiltrated and whether backups are intact.
By hour 24: reporting duties
For critical infrastructure operators a successful ransomware attack is generally reportable to the federal office within 24 hours under the Swiss reporting obligation; missing details can be added within 14 days. If personal data is affected and there is a high risk to data subjects, the FDPIC must also be informed as soon as possible under Art. 24 FADP (data breach notification). Companies under the GDPR have 72 hours; financial institutions have their own channels to FINMA. The federal office also recommends filing a criminal complaint with the police.
Ransom
The Swiss federal cybersecurity office advises against paying ransom. Payment guarantees neither decryption nor that stolen data will not be published anyway, and it funds further attacks. Whether to decide otherwise in an exceptional situation is a management decision with legal advice, not a spontaneous reaction. Good backups mean the question never arises.
Communication
Staff need clear instructions early: which devices must not be used, how to communicate if email is down, and that no information goes outside. Customers and partners are informed once it is clear whether they are affected, factually and without speculation. A prepared template saves much time in this phase.
Recovery
Restore from backups demonstrably created before the attack and clean, in a defined order of business priority. Before that, change all passwords, especially for administrators and service accounts, and close the entry route. Restoring without fixing the cause often leads to a second hit. Whether backups can deliver depends on the 3-2-1 rule and on whether restore was ever practised.
Afterwards
A debrief clarifies how the attackers got in, what worked and what did not. The typical measures are well known: multi-factor authentication everywhere, updates of internet-facing systems, fewer admin rights, a tested immutable backup and an exercised plan. We support the set-up in the cyber readiness check; reporting channels are summarised in the cyber reporting checklist.