Ransomware Recovery Guide: How to Mitigate an Attack and Regain Data Integrity
August 7, 2026
August 7, 2026
Your file server starts renaming things at 3:14 AM. Nobody notices until 8. By then every share is encrypted, the backup job that ran at 2 AM wrote to a mapped drive that also got hit, and there’s a text file on the desktop with a wallet address.
That’s the version most businesses actually experience. Not a targeted nation-state operation. Just an opportunistic crew that found an unpatched edge device and walked in.
Ransomware showed up in 48% of all confirmed breaches in the Verizon 2026 Data Breach Investigations Report, up from 44% the year before. And the victim profile is not what most people assume. Where organizational size was known, 96% of ransomware victims were small and medium-sized businesses.
Recovery comes down to three phases: contain the spread, restore from clean backups, and verify the environment before you reconnect anything. Everything below is the detail inside those three phases, in the order you’ll need it.
Ransomware is malicious software that encrypts files or locks systems until a ransom is paid. That definition is accurate and mostly useless during an incident, because what matters operationally is which type you’re dealing with.
Crypto ransomware encrypts files and leaves the operating system functional. You can log in. You just can’t open anything.
Locker ransomware locks the whole device. Less common now, easier to recover from, because your data is usually still intact underneath.
Double extortion encrypts your files and exfiltrates a copy first. Attackers then threaten publication. This is the dominant model, and it’s why “we have backups" no longer means “we’re fine." Backups solve the encryption problem. They do nothing about the copy sitting on someone else’s server.
The shift is measurable. Sophos found under half of attacks now result in data being encrypted, down from 66% in 2024, while extortion-only attacks keep climbing. Defenders are catching encryption earlier. Attackers responded by making encryption optional.
What this means: Your recovery plan needs a data breach notification track running in parallel with the technical restore.
The entry-point data shifted meaningfully in the last two years. Exploitation of vulnerabilities reached 31% of initial access vectors in the 2026 DBIR, up from 20% the year before, driven by ransomware campaigns hitting unpatched flaws in edge devices and VPNs. Sophos independently put exploited vulnerabilities at 32% of incidents, the third year running it topped their list.
Phishing still matters. It’s just no longer the leading vector. Among the 73% of ransomware victims who experienced an infostealer or credential compromise, 50% had credentials stolen within 95 days before the ransomware hit.
Read that again. The breach usually starts months before the encryption. Somebody’s personal laptop picked up an infostealer in April and the payload detonates in July.
The ransom is rarely the biggest line item.
IBM’s Cost of a Data Breach 2025 put the global average cost of a breach at $4.44 million USD, with the US average rising to $10.22 million. Separately, Sophos found average recovery costs excluding the ransom itself fell 44% to $1.53 million USD in 2025, across 3,400 organizations surveyed in 17 countries.
Costs are falling. That’s real progress, and it’s almost entirely down to better backup discipline.
| Cost component | What drives it |
|---|---|
| Downtime | Halted operations, idle staff, missed contractual deadlines |
| Recovery labor | Forensics, rebuilds, IT overtime, external incident response retainers |
| Regulatory exposure | GDPR, HIPAA, and state breach notification obligations |
| Legal | Class actions, which can proceed on exposure risk alone without proven financial loss |
| Reputational | Customer churn, delayed deals, insurance repricing at renewal |
The ransom is one line in this table. Everything else keeps billing after the encryption stops.
Speed matters more than accuracy here. You can misdiagnose the strain and recover fine. You cannot un-spread ransomware.
Pull the network cable. Disable Wi-Fi at the adapter, not just by disconnecting from the SSID. Unplug USB drives and external storage. Disable Bluetooth.
If files are actively being encrypted right now, power the machine down. You’ll lose volatile memory that forensics would have liked. You’ll also stop the encryption, which is the better trade in almost every case.
Then find what’s not infected and segment it off. Ransomware moves laterally through mapped drives, domain trusts, and management agents. Your unaffected systems are unaffected for the next few minutes only.
Once the spread has stopped, work out what you’re dealing with.
Check for ransom notes on desktops and in shared folders. Look at file extensions, since encrypted files typically carry an appended extension. No More Ransom’s Crypto Sheriff, run by Europol and the Dutch National Police, will match an uploaded sample or ransom note against known families and tell you whether a decryptor exists.
Document everything as you go. Affected hostnames, timestamps, file counts, the exact ransom demand, any attacker communication. You will need this for the insurer, the regulator, and law enforcement, and you will not remember it accurately in three weeks.
Internal first: IT, leadership, legal, and whoever owns your incident response plan.
External next. In the US, report through CISA or the FBI’s Internet Crime Complaint Center. You only need to report once for all federal agencies to be notified. In the EU, GDPR gives you 72 hours from awareness to notify your supervisory authority where personal data is affected.
Tell customers and vendors what’s required by your regulatory obligations and your contracts, on the timeline those obligations specify. Be direct about scope. Don’t publish technical detail that helps the attacker understand what you’ve discovered.
If your recovery plan assumes you can pull a clean desktop image on demand, test that assumption before you need it. See our pricing if you want to work out what a standby cloud desktop environment costs against a day of downtime.
This is the part that determines whether the incident is a bad week or an existential event.
Assume the backups were targeted. Modern ransomware operators go after backup repositories deliberately, which is why CISA’s #StopRansomware Guide treats backup isolation as a prerequisite rather than a nice-to-have.
Scan backup images in an isolated environment before restoring. Check that your most recent clean restore point predates the initial compromise, not the encryption event. Those are often weeks apart.
Do not mount backup storage to an infected host. That’s how organizations lose the one thing that was going to save them.
Bring back the systems that resume revenue first. For most SMBs that’s identity, email, the line-of-business application, and file shares, roughly in that order.
Test each restored system before the next one. Confirm data integrity, confirm the application actually launches, confirm permissions survived.
Sophos found 53% of organizations fully recovered within one week in 2025, up from 35% in 2024, though 18% still took more than a month. Recovery speed tracks closely with whether backups were isolated and tested before the incident, not with budget.
Run reputable anti-malware across every endpoint, not just the ones you know were hit. For anything that was encrypted, rebuild rather than clean. Wiping and reimaging is faster than proving a machine is clean, and it’s the only approach that actually rules out persistence mechanisms.
Patch what let them in. If the entry point was an unpatched VPN appliance, restoring a clean image onto the same network behind the same appliance buys you about a week.
Reconnect in stages. Watch network traffic for beaconing. Rotate every credential, including service accounts and API keys, because credential theft precedes most of these incidents.
Most organizations now don’t. 69% of victims in the 2026 DBIR did not pay, and the median ransom actually paid fell to $139,875 USD, continuing a downward trend from $150,000 the previous year.
The arguments against paying are practical, not just ethical:
When it gets considered anyway: mission-critical data with no viable restore point, or an operational outage causing harm that exceeds every other risk. Hospitals face this calculus differently than accounting firms do.
If you get to that point, involve legal counsel and your cyber insurer before anything else. Insurers frequently have negotiators on retainer and specific notification requirements that void coverage if skipped.
Check No More Ransom’s decryption tool library first regardless. It’s free, it covers hundreds of families, and it costs you twenty minutes.
Recovery speed is decided long before the attack, by decisions that look boring on a Tuesday.
An untested plan is a document, not a capability. Yours needs named owners for isolation, communications, and restore decisions. It needs out-of-band contact details, because your email is probably down. And it needs a tabletop exercise at least annually.
If you’re starting from nothing, NIST IR 8374 Revision 1, finalized in June 2026, maps ransomware preparedness against the Cybersecurity Framework 2.0 and doubles as a readiness self-assessment.
The test that matters: can someone who is not you execute the first hour?
The 3-2-1 rule still holds, with an addition. Three copies, two media types, one offsite, and at least one immutable or air-gapped copy that cannot be modified even with domain admin credentials.
Test restores monthly. Not backup job success reports. Actual restores, timed, to confirm both integrity and recovery speed.
The endpoint is where most of this starts. When business data and applications live in a hosted environment rather than on individual laptops, a compromised device stops being a compromised dataset.
That’s the structural argument for desktop virtualization in a ransomware context. Our cloud desktops run in isolated environments with daily automated backups, MFA and SSO support, and centralized patching, which closes the vulnerability window that now accounts for 31% of initial access. Compromise one user’s session and the blast radius is one session, not a file server.
It isn’t a silver bullet. A cloud desktop with a weak password and no MFA is still a cloud desktop with a weak password. But it changes the default from “every laptop is a potential entry point into everything" to something you can actually monitor. The device-level half of this problem is covered in our guide to endpoint security best practices.
| # | Phase | Actions |
|---|---|---|
| 1 | Contain | Disconnect infected devices (Ethernet, Wi-Fi adapter, Bluetooth, USB). Power down actively encrypting machines. Segment unaffected systems. |
| 2 | Assess | Identify the strain via ransom notes, file extensions, or No More Ransom’s Crypto Sheriff. Map affected hosts. Document timestamps, demands, and communications. |
| 3 | Report | Notify IT, leadership, and legal. File with CISA or the FBI IC3. Meet GDPR or HIPAA notification deadlines. Contact your cyber insurer before acting. |
| 4 | Restore | Scan backups in isolation. Confirm the restore point predates initial compromise, not just encryption. Restore revenue-critical systems first. Test each one. |
| 5 | Remove | Rebuild encrypted machines rather than cleaning them. Full-network anti-malware sweep. Patch the entry-point vulnerability. |
| 6 | Verify | Rotate all credentials including service accounts. Monitor for beaconing. Reconnect in stages, not all at once. |
| 7 | Prevent | Post-incident review. Security awareness training. Add an immutable backup copy. Update the IR plan with what actually happened. |
Print this. During an incident, nobody is reading a blog post.
Most SMB ransomware incidents trace back to an unpatched device or a credential nobody rotated. If you want a second opinion on where your gaps are, talk to a cloud expert and we’ll walk through your current setup.
Sophos found 53% of organizations fully recovered within one week in 2025, up from 35% in 2024, while 18% took more than a month. Recovery speed correlates closely with whether backups were isolated and tested before the incident.
Sometimes. No More Ransom, a joint Europol and Dutch National Police project, publishes free decryptors for known ransomware families. For everything else, restoring from clean backups is the only reliable path. Encryption used by modern ransomware cannot be broken by brute force.
69% of victims in the 2026 Verizon DBIR did not pay, and the median ransom paid fell to $139,875 USD. Payment doesn’t guarantee a working key, doesn’t address exfiltrated data, and may create sanctions exposure. Involve legal counsel and your cyber insurer before considering it.
Only if they’re immutable or air-gapped. Attackers target backup repositories deliberately, which is why CISA’s #StopRansomware Guide treats backup isolation as a prerequisite. A cloud backup mounted as a writable drive is as vulnerable as local storage.
They reduce the blast radius rather than eliminating the risk. When data and applications live centrally instead of on endpoints, a compromised device doesn’t hand over your file server. Our cloud desktops are backed up daily and support MFA and SSO, though those controls only work if you enable them.
Isolate before you investigate. Disconnect affected machines from the network, disable wireless at the adapter level, and power down anything actively encrypting. Diagnosis can wait ten minutes. Lateral spread cannot.
In most jurisdictions, yes, if personal data was involved. GDPR requires notification to your supervisory authority within 72 hours of awareness. HIPAA, PCI DSS, and US state breach laws each carry their own timelines. In the US you can report once through CISA and all federal agencies are notified.
Your V2 CloudCare team — real people, on the line.
