You arrive in the morning and every document on the file server has a new extension. Each folder holds a ransom note demanding cryptocurrency in exchange for a decryption key, and threatening to publish stolen data if you don't pay. Encryption is usually the last step of the attack: by then the attackers have typically gained administrative rights, deleted whatever backups they could find and taken data out. The full sequence is covered in How ransomware gets into a company. What you face over the next hours and weeks is a different set of questions: how to stop the damage without destroying evidence, whether data was stolen, whether a free decryptor exists, in what order to restore systems, and whether to pay.

This article is for the IT leads and executives who have to make decisions on the day the encryption is found. Generic first-day steps for any intrusion, such as naming an incident lead, switching to out-of-band communication, preserving logs and timing credential resets, are in The first 24 hours of a suspected breach and are not repeated here; this article adds what is specific to ransomware. It draws mainly on the response checklist in the #StopRansomware Guide published jointly by CISA, MS-ISAC, NSA and FBI in the United States[1], and on the Cybersecurity Incident Response Action Guide published in July 2026 by Taiwan's Administration for Cyber Security (ACS) under the Ministry of Digital Affairs[2].

Contain first, but don't destroy evidence

Disconnect, don't power off

CISA advises identifying the affected systems and isolating them immediately. If several hosts or subnets are affected, take the network offline at the switch level. Power devices down only if you cannot disconnect them, because shutting down loses the ransomware artifacts and evidence held in memory[1]. The ACS guide is more specific: after many ransomware strains finish encrypting, the encryption key or related runtime information may stay in memory for a short time, and shutting down, pulling the power or rebooting at that point throws away the chance for forensic staff to extract the key and decrypt without paying[2]. So the first instruction should be "unplug the network cable and turn off Wi-Fi", not "shut everything down". Coordinate the isolation so it happens in one go, and communicate by phone or other out-of-band channels so the attackers don't notice and rush to encrypt more widely[1].

Keep the ransom note, samples and all communications

Do not delete the ransom note. In its list of material that CISA and law enforcement may need for further analysis, CISA specifically warns not to remove the ransom readme file, or decryption may not be possible. The same list includes encrypted file samples, malware samples, memory captures and images of affected hosts, logs, email and other communication accounts used by the attackers, the ransom amount, the attackers' Bitcoin wallets, and copies of all communications with the attackers[1]. Assign one person to look after this material and keep it somewhere isolated from the affected network. Any contact with the attackers should be authorized by the incident lead and fully recorded.

Assume accounts and backups have been touched

Ransomware intrusions often involve mass credential theft. CISA advises identifying the systems and accounts used in the initial breach (including email accounts) and disabling VPNs, remote access servers, single sign-on and other public-facing services so the attackers cannot keep coming back in with credentials they already hold[1]. Microsoft's incident response team recommends disabling all privileged accounts except a small number that administrators need to restore Active Directory, and isolating at least one, ideally two, known-good domain controllers in every domain, putting identity first[3]. The ACS recommends resetting the passwords of domain admins and other privileged accounts immediately, while keeping a break-glass emergency account that can log in at the physical console so the response team does not lock itself out during recovery[2].

Assume the backups have been targeted as well: ransomware actors often collect credentials stored in the environment to log in to backup systems, or exploit unpatched backup software[1]. Don't reconnect offline backups to the affected network until the environment is confirmed clean. CISA also warns that a ransomware event may be evidence of an earlier compromise that was never resolved: before rebuilding from backups, find precursor malware such as Emotet or QakBot, or the rebuilt environment will be compromised again[1].

Scope it: encryption only, or was data taken too?

Whether the note says the attackers already have your data or doesn't mention theft at all, don't take it at face value; check for yourself. The ACS guide lists "claims to have stolen sensitive data in advance and threatens to publish or sell it by a deadline" as one of the signs of a ransomware attack[2]. CISA's threat-hunting steps include looking for abnormal volumes of outbound data on any port and for traces of common exfiltration tools such as Rclone, Rsync, web-based file storage services and FTP/SFTP[1]. TWCERT/CC recommends inventorying the affected data, including design and development, testing, finance, customer, supplier and credential data, so you can plan the response to data damage or leakage[4]; afterwards, investigate whether the data has appeared on the public web or the dark web[5].

Whether data was stolen determines which further legal and contractual duties apply:

  • Personal data: CISA notes that if the incident resulted in a data breach, you must follow the notification requirements in your incident response and communications plans[1]. Taiwan's current notification duty under the Personal Data Protection Act, sector-specific reporting deadlines and how to write the notice to individuals are covered in Responding to a personal data breach.
  • Listed companies: assess at the same time whether a material information announcement is required; the criteria and filing deadlines are in Cyber incident disclosure by Taiwan-listed companies.
  • Processing data on behalf of others: the ACS guide notes that a company performing outsourced work that learns of an incident should notify the commissioning organization as the contract requires and take remedial action[2].

Identify the strain and check for a free decryptor

Before anyone discusses paying, check whether there is a way out that doesn't involve paying. TWCERT/CC points out that most data encrypted by ransomware is hard to crack[4]. Still, researchers have found flaws in the encryption of some families and released decryption tools, which is why CISA advises consulting law enforcement about available decryptors even when other mitigations are possible[1].

  1. Identify the family: TWCERT/CC suggests working out the type from the ransomware's name, the extension of the encrypted files and similar details[4].
  2. Check No More Ransom: the project was started by the Netherlands police's National High Tech Crime Unit, Europol's European Cybercrime Centre, Kaspersky and McAfee, with the goal of helping victims get their data back without paying the criminals[6]. Its Crypto Sheriff tool helps identify the type of ransomware so the site can check whether a decryption solution exists[7]. TWCERT/CC likewise recommends looking on No More Ransom for decryptors from trusted security organizations[4]; download tools only from that site or the security vendor's official pages.
  3. Remove the malware before decrypting: No More Ransom warns that you should read the how-to guide before using a decryptor and remove the malware from the system first, otherwise it will keep locking the system or encrypting files[8].
  4. No tool yet? Keep the encrypted files: TWCERT/CC recommends backing up files that cannot be decrypted yet to a safe place so they can be decrypted if a tool appears later[4]; No More Ransom says it keeps working with security companies and law enforcement to find keys for as many variants as possible[7].

Recovery order: identity and infrastructure first, then business systems

CISA advises setting the restoration order from a predefined critical asset list that covers systems critical for health and safety, revenue or other critical services, as well as the systems they depend on; systems judged unaffected should be tracked separately and moved down the list[1]. When Microsoft assesses each line-of-business application that is down, the first question is whether it requires an identity, followed by whether tested backups of the application, configuration and data exist[3]. Most companies' business systems depend on Active Directory, DNS and the network, so the order usually looks like this:

  1. Set up a clean recovery environment: build a separate, isolated recovery network segment and add only systems confirmed clean, so nothing is reinfected during recovery[1].
  2. Restore identity first: Microsoft notes that when the control plane, typically Active Directory, has been compromised, a compromise recovery process may be needed[3]. Rebuild from a known-good domain controller or a trusted backup, and reset the KRBTGT account password twice[3]; for the interval between the two resets and other details, see The first 24 hours.
  3. Then core infrastructure: DNS, firewalls, VPN, the virtualization platform and the backup system itself, with configurations restored from clean backups or rebuilt.
  4. Business systems in order of importance: CISA advises rebuilding systems from pre-configured standard images, rebuilding cloud resources from infrastructure-as-code templates, and then restoring data from offline, encrypted backups in order of critical-service priority[1].
  5. End-user devices last.

Verify backups are clean before restoring

NIST IR 8374 Rev. 1, published in June 2026, lists "the integrity of backups and other restoration assets is verified before using them for restoration" among the outcomes for recovering from ransomware[9]. The ACS also requires an independent malware scan of backup images before any data is restored, to make sure they don't carry dormant ransomware or scripts left by the attackers, and only then bringing the data into the cleaned and rebuilt environment[2]. If the attackers were inside for a long time, the most recent backups may all be tainted; you will have to go back to a version from before the intrusion and tell the business how much data that loses. How to design backups in the first place is covered in Backup strategy: the 3-2-1 rule, immutable copies and restore drills.

Close the way in before reconnecting

CISA advises identifying the systems and accounts involved in the initial breach and looking for outside-in persistence (for example backdoors on perimeter devices or rogue accounts) and inside-out persistence (for example malware implanted on the internal network or misuse of PsExec or Cobalt Strike). Once the environment has been fully cleaned and rebuilt, reset passwords for all affected systems, fix the associated vulnerabilities and gaps in security, and update customer-managed encryption keys as needed[1]. Microsoft also recommends installing all missing security updates and confirming that every external-facing service, including VPN, is protected by multi-factor authentication[3]. After reconnecting to the production network, the ACS advises continuing to monitor internal traffic and scan endpoints for unexpected connections, leftover malware or signs of the attackers returning[2]. CISA suggests that a designated IT or security authority declares the incident over based on criteria set in advance[1].

Whether to pay: what management needs to know first

NIST describes the dilemma ransomware creates for management as two paths: pay the ransom and hope the attackers keep their word to restore access and not disclose the data, or don't pay and try to restore operations yourself[9]. This is a business decision, not a technical question IT can settle alone. Before anyone decides, at least the following facts should be on the table.

What officials and law enforcement say

  • CISA, MS-ISAC, NSA and FBI do not recommend paying a ransom, and point out that paying does not ensure your data will be decrypted, that your systems will no longer be compromised, or that your data will not be leaked[1].
  • No More Ransom notes that even with the right key, bugs in the malware can leave the data unrecoverable, and that paying proves to criminals that ransomware works[7].
  • In the advisory described in the next section, the US Treasury says such payments enrich malicious actors and incentivize further attacks, and that paying gives no guarantee of regaining access to data or being free from further attacks[10].

US sanctions risk: OFAC's 2021 advisory

CISA's guide warns that paying a ransom may carry sanctions risk[1]. The US Treasury's Office of Foreign Assets Control (OFAC) issued an updated advisory on 21 September 2021, superseding the version of 1 October 2020. Its main points[10]:

  • The US government strongly discourages private companies and individuals from paying ransom or extortion demands.
  • US persons, wherever located, are generally prohibited from transacting, directly or indirectly, with individuals or entities on OFAC's Specially Designated Nationals (SDN) List, other blocked persons, and comprehensively embargoed countries or regions (for example North Korea and Iran). A transaction by a non-US person that causes a US person to violate sanctions is also prohibited.
  • Civil liability for sanctions violations is strict: a person subject to US jurisdiction can be held liable even without knowing the counterparty was sanctioned.
  • Financial institutions, cyber insurers and digital forensics and incident response firms that pay on a victim's behalf not only encourage future ransom demands but may themselves violate OFAC regulations.
  • License applications involving ransomware payments are reviewed case by case with a presumption of denial.
  • Meaningful cybersecurity measures taken beforehand, and a self-initiated, complete report to law enforcement as soon as possible after discovering the attack followed by ongoing cooperation, are treated by OFAC as significant mitigating factors.

The advisory describes itself as explanatory only, without the force of law; the binding rules are the US statutes and regulations it cites[10]. It concerns transactions and persons within US jurisdiction, not every Taiwan company directly. Whether a given case involves US persons or US companies (for example the bank, insurer or response firm handling a payment) is a question for legal counsel.

Who needs to be involved in the decision

  • Executive management: NIST frames whether to pay as a dilemma for management[9], and CISA advises keeping management and senior leaders informed with regular updates as the situation develops[1].
  • Legal: assesses sanctions, personal data, contractual and securities disclosure obligations, and makes sure records of all contact with the attackers are kept.
  • Insurer: CISA lists the cyber insurance company among the stakeholders to engage[1]; if you have a policy, check its requirements on notification deadlines and designated response firms first.
  • Law enforcement: CISA advises consulting law enforcement about decryptors[1], and OFAC treats prompt reporting and ongoing cooperation as mitigating factors[10].

Whatever the decision, the ransom amount, whether it was paid and the wallets used to pay are all on CISA's list of information law enforcement may need[1], and the assessment and decision process should be recorded too. Paying does not end the incident: removing persistence, rebuilding and closing the way in still have to be done.

Reporting and notification in Taiwan

  • Police report: the TWCERT/CC ransomware site recommends filing a report at the nearest police station with evidence such as photos showing the encrypted data, or seeking help from the Criminal Investigation Bureau or the Investigation Bureau of the Ministry of Justice (the site lists their contact addresses)[4]. The ACS guide also lists "if a crime is involved, report it to the local police" among external notifications[2].
  • TWCERT/CC: the same site recommends reporting the incident to TWCERT/CC as well[4]; afterwards, de-identified incident information can be shared through TWCERT/CC to help other organizations defend themselves[5]. How ordinary companies report online or by email is covered in The first 24 hours.
  • Specific non-government agencies under the Cyber Security Management Act: under the Regulations on Reporting, Response and Drills for Cyber Security Incidents, renamed and amended in full on 5 January 2026 (formerly the Regulations on Reporting and Response to Cyber Security Incidents)[11], an incident must be reported within one hour of becoming aware of it, in the manner designated by the central competent authority for the sector, with follow-up reports if the incident level changes (Article 11). Damage control or recovery must be completed within 72 hours for level 1 and 2 incidents and within 36 hours for major incidents, and an investigation, handling and improvement report is due within one month after that (Article 13)[12]. Who is covered and how incidents are graded is explained in Taiwan's Cyber Security Management Act.
  • Material information and personal data: see the links in the scoping section above; work on both in parallel with technical recovery rather than waiting until systems are back.

Action checklist

  1. Disconnect, don't power off: unplug network cables and turn off Wi-Fi, and take the network offline at the switch level if several segments are affected; coordinate by phone and isolate everything in one go.
  2. Keep the ransom note, encrypted file and malware samples, memory captures and logs, with one person in charge of them; do not delete the ransom note.
  3. Disable VPN, remote access, single sign-on and other external entry points, disable non-essential privileged accounts, keep a break-glass account, and isolate one or two known-good domain controllers.
  4. Don't reconnect offline backups until the environment is confirmed clean; scan and verify every backup before restoring from it.
  5. Check whether data was stolen, inventory the affected data, and have legal assess personal data, material information and contractual notification duties.
  6. Identify the family from the ransom note and file extension, and check No More Ransom for a decryptor; keep encrypted files that can't be decrypted yet.
  7. Restore in this order: recovery network segment, Active Directory and identity, core infrastructure, critical business systems, end-user devices.
  8. Find and fix the initial access vector, remove persistence, reset all passwords and install missing updates before reconnecting, then keep monitoring.
  9. Have management, legal and the insurer jointly assess whether to pay, consult law enforcement first, and record the decision process and all contact with the attackers.
  10. Report to the police and to TWCERT/CC; organizations covered by the Cyber Security Management Act must report to their competent authority within one hour. If you need outside forensic and recovery support, see our incident response service.
  11. Afterwards, fill the gaps this incident exposed in backups, logging and account tiering, and use real cases from our ransomware category to run a tabletop exercise.