In the first 24 hours after a ransomware attack, a Houston business should shut the attacker out of its accounts, get its insurer and a breach lawyer involved, and save evidence before anything is wiped or restored. Repairs mostly come later.
If the ransom note only just appeared, read our guide on what to do in the first hour of a ransomware attack first. This one picks up after that. I wrote it for owners and office managers at Houston companies of 20 to 300 people, because the end of day one is when the expensive decisions tend to get made, often by tired people. The service side is on our ransomware incident response in Houston page.
Hour one is about pulling cables and phoning people. After that the job changes. You lock down accounts, copy evidence before anyone wipes a machine, hire the forensic firm your insurer will pay for, and try to find out whether data left the building. Some Houston industries owe a federal report within hours, as little as 1 hour for grid operators. Restoring the file server usually waits until day two or later.
What does the first day of ransomware response cover?
Ransomware response in the first 24 hours is the stretch between spotting an attack and starting the actual recovery. Most of it is containment and investigation. The legal and insurance work runs alongside, and fixing machines is a small slice of the day.
We follow the order in the ransomware checklist CISA publishes with the FBI and other agencies. The checklist doesn’t attach times to anything. So the hour ranges below are our own estimates for a company that already has an IT provider on the line, and a larger network (or a backup that turns out to be missing) will stretch all of them.
How should the first 24 hours be divided?
We split the day into 5 blocks. In real incidents they overlap, and a small office can get through two of them in one afternoon.
| Hours | Main job | Usually handled by |
|---|---|---|
| 1 to 4 | Disable compromised accounts, shut off outside access, and image a few affected machines | Your IT provider or internal IT |
| 4 to 8 | Open the claim and get counsel and an approved forensic firm engaged | Owner or CFO |
| 8 to 12 | Find the way in and look for signs of data theft | Forensic firm working with IT |
| 12 to 18 | Agree on restore order and stand up a clean network | IT provider with department heads |
| 18 to 24 | Take stock, decide on notices, plan day 2 | Owner, counsel, and insurer |
You’ll notice restoring the file server isn’t in there. Owners push back on that more than anything else in this post, and there’s a reason for it further down.
How do you keep the attacker out once machines are disconnected?
Pulling network cables stops the encryption from spreading. It does nothing about the passwords the attacker already has, or about the VPN account or remote access tool they may have set up weeks before anyone noticed. Hours 1 to 4 go to that problem.
Start by disabling the accounts you believe are compromised. That includes service accounts, and any domain admin account that was ever typed into an infected machine. Outside access through VPN and remote desktop should stay off until somebody has gone through the logs.
People always want to reset every password right away. Don’t, at least not yet. CISA saves mass resets for the end, after systems are cleaned and rebuilt, and the logic is simple enough. A new password typed on a machine the attacker still controls goes straight to the attacker.
CISA’s checklist is also specific about what to look for. New admin accounts are on it, along with VPN logins from places your staff have never been, PowerShell running where it shouldn’t, and tools like vssadmin, which attackers use to delete the Windows shadow copies you might otherwise restore from. The one that matters most for later is dropper malware, the small program that got the attacker in before the ransomware itself ran. Restore while it’s still on the network and you’ll be rebuilding into the same breach.
Evidence gets collected in this window too. CISA recommends disk images and memory captures from a sample of the affected devices, plus snapshots of any cloud volumes. Defense contractors carrying the DFARS 7012 clause have a harder rule, since they must keep images of the affected systems for at least 90 days after filing their report.
Who should be on the call by hour 8?
Your cyber insurer’s claims line goes first. A breach lawyer comes next, and the forensic firm after that. Plenty of policies name approved forensic and legal vendors, and the claims team can tell you which ones.
I’d hold off on signing anyone’s engagement letter until both the insurer and the lawyer have read it. If you hire a forensic firm outside the policy terms, you may end up paying for it yourself. Counsel may also want to hire that firm directly. Whether that protects the final report as privileged is a legal question, and we’re not lawyers, so ask yours.
Law enforcement should have heard from you in hour one. If that slipped, call the FBI’s Houston field office now at (713) 693-5000 (it takes reports around the clock), and see our post on who to report a ransomware attack to in Houston for the other routes. Reporting early also helps you later. In its ransomware advisory, Treasury’s sanctions office says a complete report to law enforcement soon after discovery is a significant mitigating factor if a payment ever turns out to have gone to a sanctioned group.
Which reporting deadlines can run out on day one?
For most Houston businesses, nothing legally expires in the first 24 hours. Texas allows 60 days to notify affected residents, and 30 days to notify the Attorney General once 250 or more Texans are involved, both counted from when you determine a breach happened. Our data breach response plan for Texas goes through those notices.
Houston has a lot of companies in industries with much faster clocks, though. Here are the ones we run into, with what starts each clock.
| Who it applies to | Deadline | Report goes to |
|---|---|---|
| Electric utilities with medium or high impact grid systems under NERC CIP-008-6 | 1 hour after determining a reportable incident | E-ISAC and CISA |
| Banks supervised by the FDIC, OCC, or Federal Reserve | 36 hours after determining a notification incident | The bank’s primary federal regulator |
| Bank service providers, which can include IT vendors | As soon as possible after a disruption of 4 hours or more | Each affected bank customer |
| Pipeline owners covered by TSA’s pipeline security directive | 72 hours after identifying the incident | CISA |
| Defense contractors with the DFARS 7012 clause | 72 hours after discovery | The Department of Defense through DIBNet |
| Firms licensed by New York’s Department of Financial Services | 72 hours, and 24 hours after any ransom payment | New York DFS |
| Any Texas business holding sensitive personal data | 60 days for residents and 30 days for the Attorney General | Affected Texans and the Texas Attorney General |
Those rows come from the NERC CIP-008-6 standard, the federal incident notification rule for banks, the DFARS 252.204-7012 clause, and New York’s 23 NYCRR 500.17. Filing with DoD requires a medium assurance certificate, which you can’t get in a hurry once an incident has started.
The pipeline number moved recently. In TSA’s May 2024 directive it was 24 hours. The version in effect since January 16, 2026 gives 72. If your incident plan dates from 2023 or 2024, open it and check which figure it uses.
Companies that sell to a pipeline, utility, or bank should pull their customer contracts too. A contract can set its own notice period, and it can be shorter than anything in the regulations above.
What should you know by hour 24?
By the end of day one, whoever is running the response should have at least a working answer to each of these 6 questions.
- How did the attacker most likely get in, and is that way in closed now?
- Which systems are encrypted, which are confirmed clean, and which hasn’t anyone checked?
- Is there any sign data was copied out, and if so, what kind?
- Which backup is the last clean one, and has anyone tested a restore from it?
- Which reporting deadlines apply, who’s filing each one, and when did each clock start?
- What have employees, customers, and vendors been told, and who is allowed to speak for the company?
Question 3 is often still open at hour 24, and that’s normal. Write “unknown” instead of guessing. The Texas clock starts when you determine a breach happened, so counsel will want a record of when each fact came to light.
When should you restore, rebuild, or think about paying?
Restoring comes after the way in is closed and the dropper is gone. CISA’s advice is to bring systems back by priority, working from a list of critical assets you made ahead of time, onto a network you’ve confirmed is clean. For most of our Houston clients we restore identity first (Active Directory or Microsoft Entra ID), then email and phones, then the system that sends invoices and runs payroll.
Not every machine deserves a restore. CISA points out that older hardware can cause compatibility problems when rebuilt from standard images, and sometimes it’s quicker to replace an old server than to nurse it back. You’ll know which ones fall in that group somewhere around hours 12 to 18.
Everyone asks about paying the ransom early, and on day one nobody has the information to answer it. You don’t know yet what was taken, or whether the backups work. OFAC adds a legal wrinkle, because it can impose civil penalties on a strict liability basis, even when the company paying had no idea the group was sanctioned. We cover the decision itself in whether a Houston business should pay the ransom, and the costs in what ransomware recovery costs in Houston.
What do you tell employees and customers on day one?
Talk to employees by phone or face to face. The attacker may still be able to read company email and Teams, so don’t announce anything there. Staff need to hear three things from you. Nobody logs in to anything until IT says it’s safe, nobody posts about the outage, and every outside question goes to one person you name.
Customers usually get a short holding statement that counsel has looked over. It says there’s a disruption, that outside specialists are investigating, and when the next update will come. Don’t promise that no data was taken until forensics can prove it. That’s the line companies most often have to take back.
Where does an IT provider fit in the first 24 hours?
Uprite is a managed IT and security provider. We aren’t a forensic firm, and the formal investigation belongs with a specialist your insurer approves. Our share of day one is the hands-on work. We lock accounts, collect images when the forensic team asks for them, build the clean network, and restore in the order everyone agreed on. Our incident response services in Houston page has the details.
Across all clients, our first response averages about 5 minutes, and every ticket gets triaged within 10. That’s a help desk measure, not a ransomware recovery time. We have offices in Houston, San Antonio, Dallas, and Katy. Day two onward is covered in our guide to ransomware recovery in Texas. If you’d like someone watching alerts overnight so the next attack gets caught earlier, look at our managed detection and response service and our notes on ransomware protection for Houston businesses.
What Houston owners ask about the first day after a ransomware attack
Should we restore from backup in the first 24 hours?
Usually not until the attacker’s way in has been found and closed. CISA warns that restoring before the dropper is removed can put you right back in the same breach. A system you need for safety or revenue can come back earlier, on a separate network that’s been checked.
How long does it take to find out whether data was stolen?
Often more than a day. Investigators have to pull firewall, VPN, and cloud logs before they can look for signs of copying, and collecting them can take days. Until then, the honest answer is “unknown,” with a note of when you learned each new fact.
Does Texas require a ransomware report within 24 hours?
Not for most private companies. Texas allows 60 days to notify affected residents and 30 days to tell the Attorney General once 250 Texans are involved. Grid operators, banks, pipeline owners, defense contractors, and New York licensed firms run on shorter clocks.
Who should hire the forensic firm?
Ask your insurer and your lawyer before anyone signs. Policies often list approved vendors, and a lawyer may want to engage the firm directly. A firm hired outside those terms could leave you with the invoice.
Can people keep working during the investigation?
Some work can continue, depending on what was hit. Teams usually get by for a few days on phones, paper, and devices that were never on the company network, and those devices have to stay away from the affected systems.
Should we change every password on day one?
No. Disable the accounts you think are compromised, then reset everyone else after the rebuild. CISA puts mass resets last because a password typed on a compromised machine can be captured.
You can plan these 24 hours before you ever need them. We’ll go through your backups, your insurance notice terms, and the deadlines that apply to your industry, then write down who handles each part of the day. If an attack is happening now, call (866) 570-3065 instead.
Plan Your Ransomware ResponsePrefer email? Reach the team through our contact page.
