Ransomware Incident Response in Houston, TX
Ransomware incident response in Houston is the process of isolating infected systems, determining what data left the network, verifying which backups are clean, and restoring operations within Texas and federal notice deadlines. Uprite provides it as part of managed security plans starting at $40 per user per month, within our managed IT services in Houston.
Containment, evidence preservation, backup verification and recovery from a Houston-based team that already manages your network.
Talk to a Security ExpertAlready affected? Call (281) 956-2280. Planning ahead? Tell us where your backups are stored and we will identify the gaps.In Texas Since 1999 | MSP 501 Winner 7 Years Running | SOC 2 Type 1 (2023) | 120-Day Satisfaction Guarantee
Talk to a Security Expert
Recognized Across Texas for Cybersecurity and Managed IT
Who Gets Hit
Which Houston Businesses Does Ransomware Actually Hit?
The federal count is public.
In its 2025 Internet Crime Report, the FBI’s Internet Crime Complaint Center (IC3) recorded 3,611 ransomware complaints and 63 newly identified variants, an average of 5.25 per month. More than 1,400 of the complaints came from organizations outside the 16 critical infrastructure sectors. Within that group, legal services accounted for 18%, contracting services for 17%, and engineering and architectural services for 10%.
All three are large Houston industries.
County Business Patterns data for 2023 from the Census Bureau list 4,116 law offices (NAICS 5411), 3,232 architectural and engineering firms (NAICS 5413) and 11,026 building and specialty trade contractors (NAICS 236 and 238) in the Houston-Pasadena-The Woodlands metropolitan area, a combined 18,374 establishments. Engineering employment in the metro, 74,297 jobs, is about 2.1 times what Houston’s share of national employment would predict, by our calculation from the same file.
IC3 also reports that the ten most frequently reported variants (Akira, Qilin, INC/Lynx/Sinobi, BianLian, Play, RansomHub, LockBit, DragonForce, SafePay and Medusa) most affected critical manufacturing, healthcare and public health, and government facilities, three sectors with a large Houston footprint along the Ship Channel and in the Texas Medical Center.
Reported ransomware losses for 2025 totaled $32,320,105. The FBI notes that the figure excludes lost business, time, wages, files, equipment and third-party remediation, and that some victims report no loss amount at all, so it understates the real cost.
Prevention is covered separately in our ransomware protection guide for Houston businesses. The sections below describe the response side, meaning what Uprite does for client companies once ransomware is confirmed on their network.
What Response Covers
What Does Ransomware Incident Response in Houston Include?
CISA’s checklist has four parts.
In practice a ransomware case involves six overlapping workstreams, some technical and some legal, which typically run in parallel for several days. The cards below list them in the order they usually begin.
The first is isolation. The CISA #StopRansomware Guide instructs organizations to determine which systems were impacted and isolate them immediately, and to power devices down only if they cannot be disconnected from the network, since a powered-off machine loses volatile memory that investigators may need.
Scoping is second. Because many ransomware groups copy data before encrypting it, the work includes reviewing firewall, sign-in and file-share logs for unusual outbound transfers in the days before the ransom note, identifying the accounts used, and listing the shares that held client or employee records.
Backup verification follows. An attacker with administrator rights can usually reach any backup that the network can reach, and the backup server and its restore points must be confirmed clean before data is restored from them.
Rebuilding follows the CISA sequence, which calls for rebuilding systems based on the prioritization of critical services and issuing password resets for affected systems after cleanup. Passwords reset before the attacker is removed can be captured again.
Records and notices complete the list. Insurers and regulators both ask for them, and our page on ransomware reporting rules for Houston businesses sets out who is notified and in what order.
The 6 Jobs in a Ransomware Response
Isolate
Infected machines cut off at the switch or by endpoint isolation, and the accounts in use disabled.
Scope
What was encrypted, what was copied out, and which accounts the attacker used to get there.
Check the Backups
Restore points confirmed out of the attacker’s reach before anyone restores from them.
Rebuild Identity
Administrator accounts cleaned up first, passwords reset once the attacker is out.
Restore in Business Order
Payroll, billing and the line-of-business system come back before the file archive.
Keep the Record
A dated log of every action, for counsel, the insurer and any regulator who asks.
A recurring gap in the Houston plans we review is the backup console itself. If it authenticates with the same domain administrator account the attacker has taken, the backups are exposed along with everything else, and a two-day restore can become a full rebuild. A free network assessment identifies that dependency before an incident.
The Rules
Which Rules Apply Once Ransomware Is Confirmed?
A few rules apply to ransomware that a plain server outage never triggers. The daily defense sits in our cybersecurity services in Houston, and the rules below are the ones that matter after it has failed.
Health data first. The HHS Office for Civil Rights fact sheet on ransomware and HIPAA says that when ransomware encrypts electronic protected health information, a breach has occurred, because the data was acquired by someone with no right to it. The breach is presumed unless the practice can show a low probability of compromise through a four-factor risk assessment, and it has to keep the paperwork that supports the conclusion.
Payment comes second. The Treasury Department’s Office of Foreign Assets Control advisory of September 21, 2021 says the U.S. government strongly discourages paying ransom, that sanctions penalties apply on a strict liability basis even when the payer had no idea the recipient was sanctioned, and that a prompt, complete report to law enforcement or CISA is a significant mitigating factor. The advisory lists incident response companies and cyber insurers among the businesses that can face exposure for helping a payment along.
State law adds a separate deadline.
Under Business and Commerce Code 521.053, a business must notify affected Texas residents no later than the 60th day after determining that a breach occurred, and must notify the Attorney General within 30 days when the breach involves at least 250 residents. NIST SP 800-61 Revision 3, published in April 2025, is guidance rather than law for private companies, but cyber insurers and auditors frequently reference it, and it places incident response within an organization’s broader cybersecurity risk management.
HIPAA and Encrypted Patient Data
Encryption by ransomware is presumed a breach unless a four-factor assessment shows otherwise.
OFAC and Ransom Payments
Strict liability for paying a sanctioned group, with early reporting counted in your favor.
Texas Breach Notice
60 days to affected Texans, and 30 days to the Attorney General at 250 or more.
Your Policy and Your Contracts
Insurer notice windows and customer terms, which are often shorter than any statute.
After Encryption
Can a Houston Company Recover Without Paying? It Depends on the Backups.
Two situations are common.
In the first, a clean copy exists outside the attacker’s reach, and the case becomes a rebuild with no real payment question. In the second, the backups were encrypted or deleted along with production data, and the decision moves to the company’s attorney and insurer rather than its IT provider. Our decision guide on should you pay the ransom in Houston lays out the 6 questions to answer before that conversation.
Federal guidance on backups is specific. The FBI’s 2025 report recommends off-site or offline backups that are encrypted, immutable and cover the organization’s entire data infrastructure, with regular backup and restoration. HHS gave similar guidance to healthcare entities in 2016, advising them to consider keeping backups offline and unavailable from their networks. Our disaster recovery services in Houston are built on that model.
How Uprite Works a Ransomware Case, Start to Finish
Contain
Infected machines isolated, compromised accounts disabled, and scheduled backup jobs paused so nothing overwrites a clean copy.
Preserve
Logs kept and affected machines left alone, so the insurer’s forensic firm starts from the original data.
Scope
Firewall, sign-in and file-share records read for signs that data was copied out before encryption started.
Verify the Backups
Restore points checked for tampering and test-restored to an isolated network before anything goes back into production.
Rebuild
Admin accounts cleaned up, systems rebuilt in business order, and passwords reset after the attacker is gone.
Report and Review
A dated record for counsel and the carrier, then a review of how they got in and what gets closed.
Does Uprite run the whole case alone?
No. Breach counsel determines whether the incident is a notifiable breach, the cyber insurer usually appoints the forensic firm, and the FBI handles the criminal investigation. Uprite’s role is containment, backup verification, the rebuild and a documented evidence trail for the other parties. Our data breach response plan for Texas businesses describes the division of responsibility in more detail.
Restore tests and separate backup credentials are the two controls we check first.
Who Does What
Who Handles Each Part of a Ransomware Attack in Houston?
Several outside parties get involved.
Most owners meet all of them in the same week.
The table shows the usual cast for a mid-sized Houston company with a cyber policy. Your IT or security provider contains the attack and rebuilds, an attorney (often called breach counsel) decides what the law requires, the insurer’s claims team and its panel forensic firm investigate, and the FBI takes the criminal report, which is also the report OFAC counts in your favor.
Who Handles What, and When
| Party | What they handle | When they come in |
|---|---|---|
| IT or security provider (Uprite on a managed plan) | Isolates systems, keeps the logs, checks backups, rebuilds and restores | Minutes after the alert or the phone call |
| Breach counsel | Decides whether the incident is a notifiable breach and directs the notices | The first day |
| Cyber insurer and its panel forensic firm | Opens the claim, approves vendors, and investigates how the attacker got in | Within the notice window in your policy |
| FBI Houston field office or IC3 | Takes the criminal report and may know of a working decryptor | As soon as practical |
| Texas Attorney General, HHS, or another regulator | Receives notices if counsel decides the law requires them | Inside the statutory deadlines |
Insurer notice usually comes early. Most cyber policies define a notice period and a panel of approved vendors, so the claims line is typically called within the first hours, and our checklist for the first hour of a ransomware attack in Houston includes that call. For the rest of day one, see our guide to ransomware attack response in Houston.
Criminal reports go to the FBI Houston field office or to IC3 online. The CISA guide also advises consulting federal law enforcement regarding possible decryptors, even when mitigation is already under way.
Uprite does not perform certified digital forensics. When a case requires a forensic examination, the insurer’s panel firm generally performs it, and Uprite provides the preserved logs and affected machines.
Notice decisions sit with counsel. The Texas 60-day period runs from the date a breach is determined to have occurred, which counsel is best placed to establish and document.
Breaches that do not involve ransomware are covered by our incident response services in Houston.
Our part starts with containment.
By the Numbers
The Numbers Behind Ransomware Response in Houston
These figures come from the FBI, the Census Bureau, HHS and the Treasury Department, plus our own published rates and two pieces of our own arithmetic, which are marked as ours.
3,611
ransomware complaints reached the FBI’s IC3 in 2025, with 63 new variants identified during the year.
45%
of non-critical-sector ransomware complaints came from legal, contracting, and engineering and architecture firms.
18,374
Houston-metro establishments work in those three industries, per Census County Business Patterns for 2023.
87%
of those Houston establishments employ fewer than 20 people, by our count from the same Census file.
$40
is our published starting rate per user per month for managed security with ransomware response included.
| Metric | Data Point | Source |
|---|---|---|
| Ransomware complaints to the FBI’s IC3, 2025 | 3,611 | FBI IC3 2025 Internet Crime Report |
| Ransomware losses reported to IC3, 2025 | $32,320,105, excluding lost business, wages and outside remediation | FBI IC3 2025 Internet Crime Report |
| New ransomware variants identified via IC3, 2025 | 63, about 5.25 a month | FBI IC3 2025 Internet Crime Report |
| Five most-reported variants | Akira, Qilin, INC/Lynx/Sinobi, BianLian, Play | FBI IC3 2025 Internet Crime Report |
| Non-critical-sector ransomware complaints by industry | Legal 18%, contracting 17%, engineering and architecture 10% | FBI IC3 2025 Internet Crime Report |
| Houston-metro law offices (NAICS 5411) | 4,116 establishments, 29,146 employees | Census County Business Patterns 2023 |
| Houston-metro engineering and architecture firms (NAICS 5413) | 3,232 establishments, 74,297 employees | Census County Business Patterns 2023 |
| Houston-metro building and specialty trade contractors (NAICS 236, 238) | 11,026 establishments, 163,109 employees | Census County Business Patterns 2023 |
| Share of those 18,374 establishments with fewer than 20 employees | 87% (16,043) | Our count from Census County Business Patterns 2023 |
| Houston engineering employment against its national share | About 2.1 times the U.S. concentration | Our arithmetic from Census County Business Patterns 2023 |
| HIPAA status of patient data encrypted by ransomware | Breach presumed unless a four-factor assessment shows low probability of compromise | HHS Office for Civil Rights fact sheet, 2016 |
| Sanctions penalties for paying a sanctioned group | Strict liability, with prompt reporting a significant mitigating factor | Treasury OFAC advisory, September 21, 2021 |
| Texas notice deadlines | 60 days to individuals, 30 days to the Attorney General at 250 or more | Tex. Bus. & Com. Code 521.053 |
| Uprite MSSP Security Focus, per user per month | From $40, incident response included | uprite.com/pricing |
| Uprite average first response | 5 minutes | Measured across every ticket and priority |
Pricing
What Does Ransomware Incident Response Cost in Houston?
For Uprite clients, ransomware response is included in managed security plans. MSSP Security Focus starts at $40 per user per month, or $2,000 per month for a 50-person company.
The rate is published on our public pricing page.
| Plan | Cost | Built for | What it includes |
|---|---|---|---|
| Network assessment | No charge | Companies unsure where their backups live or who holds admin rights | A read-only review of devices, accounts, backups and rules, with a ranked findings list |
| MSSP Security Focus, response included | From $40 per user per month | Firms with IT staff that need a security team behind them | Firewall management, SIEM and SOC monitoring, threat intelligence, vulnerability scanning, incident response, compliance automation, and a quarterly security review |
| Fully Managed IT | From $138 per user per month | Firms with no IT staff | Help desk, patching, backup testing, vCIO planning, the security stack, and after-hours response |
| Co-Managed IT | From $100 per user per month | Firms with one internal IT person | Engineers working alongside your own person, with response duties mapped before you sign |
Uprite does not publish a stand-alone emergency rate for non-clients. A company that is not a client and has already been hit can call (281) 956-2280, and the scope will be discussed on that call.
Third-party costs are separate from any IT plan. Breach counsel, forensic examination, notification letters and credit monitoring are usually billed directly and are often covered under the cyber policy. Our breakdown of incident response cost in Houston lists published retainer and hourly ranges, and our analysis of ransomware recovery cost in Houston prices the full bill from local wage data.
Preventive controls such as offline backups, endpoint isolation and multi-factor sign-in typically cost far less than a rebuild carried out during an active incident.
Fully Managed IT starts at $138 per user per month and includes the security stack and response. Co-Managed IT starts at $100 per user per month for companies with an internal IT person, and response duties are divided in writing before the contract is signed.
Managed plan rates are fixed for the first year, with no hidden fees and a 120-day satisfaction guarantee. Licensing and custom projects are billed separately.
Tell us where your backups are stored and who has access to them.
We will report in writing which systems a ransomware attack would reach first in your environment and what we would change beforehand.
Talk to a Security ExpertGetting Ready
How Does Uprite Get a Houston Company Ready for Ransomware?
Readiness work is scheduled around month-end close, tax season and hurricane watches.
Step 1. List Every System and Admin Account
Servers, laptops, cloud tenants, firewalls, and every account with administrator rights, including the old ones nobody closed.
Step 2. Move a Backup Copy Out of Reach
At least one copy kept offline or immutable, with backup console credentials separate from the main domain.
Step 3. Put Isolation on Every Device
Endpoint detection and response on every laptop and server, watched around the clock and able to cut an infected machine off automatically.
Step 4. Print the Call List
The insurer’s claims line, breach counsel, FBI Houston and the Uprite Houston line, printed in case email is unavailable.
Step 5. Run a Restore Test
Real files restored to an isolated network and timed, with the result recorded as a measured recovery time.
Timelines vary with the environment. A 30-person office on Microsoft 365 can be ready within a short engagement, while a 150-person contractor with job-site trailers, an on-premises file server and several generations of backup software needs more cleanup first. Our guide to ransomware recovery time in Houston covers the factors that slow a restore.
Who It Fits
Houston Companies This Is Built For
| Right fit |
|---|
| Greater Houston law firms, engineering firms and contractors, the industries behind 45% of non-critical-sector ransomware complaints to the FBI in 2025 |
| Texas Medical Center practices, clinics and their business associates, where encrypted patient data is presumed a HIPAA breach |
| Ship Channel, Pasadena and Baytown plants where a locked server stops production |
| Companies in The Woodlands, Sugar Land, Katy or Clear Lake with backups nobody has test-restored this year |
| Businesses facing a cyber insurance renewal that asks about offline backups, endpoint detection and multi-factor sign-in |
| Houston companies with one IT person who need a response team behind them overnight |
Companies that match one of these descriptions can start with a short call. Useful items to have on hand are the name of the cyber insurer and the most recent backup report.
Before You Decide
What Stops Houston Companies From Planning for Ransomware?
4 objections come up on nearly every first call.
“We have backups.”
The relevant question is where they are stored. Backups reachable from the network are generally reachable by an attacker with administrator rights, which is why the FBI’s 2025 report recommends offline, immutable copies and regular restoration.
“Our cyber insurance will handle it.”
Cyber insurance covers many costs and typically appoints the forensic firm. It does not isolate a laptop overnight or determine which backup is clean, and many policies ask which controls were in place before the claim.
“We would just pay.”
Treasury’s advisory states that the U.S. government strongly discourages payment, that sanctions penalties apply on a strict liability basis, and that payment does not guarantee data recovery. That decision belongs with counsel and the insurer, not the IT provider.
“We’re too small to be a target.”
The FBI’s sector split says otherwise. Law offices, engineering firms and contractors filed 45% of the non-critical-sector complaints in 2025, and 87% of the Houston establishments in those industries employ fewer than 20 people.
Definition
What Is Ransomware Incident Response?
3 Things That Set Uprite Apart on Ransomware Response
Response Built Into the Plan
The team that watches your network is the team that isolates the machine, so nobody waits on a new contract in the middle of an attack.
Prices You Can Check
$40 per user per month for MSSP Security Focus, $100 co-managed, $138 fully managed, all held for the first year. Every figure is on our pricing page.
2 Houston Offices
Engineers work from 5718 Westheimer Road near the Galleria and 16441 Space Center Boulevard in Clear Lake, so a switch port can be pulled by hand when it has to be.
What Clients Say
What Houston Businesses Say About Uprite
Hector and Kareem are super helpful! They are always willing to take on my computer problems even if its small. I had my mouse disappear off my screen, it was an user issue but Hector didn't make me feel small or "dumb" for this error. We love uprite!
I had been having trouble with an IT matter that I didn't think would be fixed but Arvin Ebueng from Upright took his time with me and worked with me until we were able to resolve the issue. The issue was an internal issue with the way the program was written, but Arvin came up with a great work around so that I am now able to do what I need to do at my job. Long story short, he got me access to both things that I need access to simultaneously and daily. Thanks 😊 Arvin, you are much appreciated 👏 💐 🥳.
I'm am not a "tech" person, however the team at Uprite gets me through the technological side of computers and software so that I can function on a daily basis... but the most enduring quality is that they care. Special shoot out to Mary, Sergio, Eufemio, Hector, and Jeff just to name a few... I appreciate each of you and the help you give me.
Uprite has been one of the best services the company I work with has provided for us they help us with any issues we run into and are always easy to work with, and very patient with us and friendly.
We use this IT Service at Delta Fastener, they are always helpful and prompt with their responses. They solve our computer issues quickly and effectively. A knowledgeable staff is the most important asset to a company - Uprite fills that gap for us by being a partner in business for all of our IT issues. Outsource what you don't know and focus on what is really making you money!
FAQ
What Houston Businesses Ask About Ransomware Incident Response
It covers isolating infected systems, disabling compromised accounts, preserving logs, working out what data was copied out, checking backups for tampering, rebuilding in business order, and keeping a dated record for counsel and the insurer. At Uprite it comes with managed security plans from $40 per user per month.
For Uprite clients, response is included in the plan. MSSP Security Focus starts at $40 per user per month ($2,000 per month at 50 users) and Fully Managed IT at $138. Breach counsel, forensic examination and notification costs are billed separately and are often covered by the cyber policy.
The decision belongs with the company’s attorney and insurer, not its IT provider. Treasury’s Office of Foreign Assets Control strongly discourages payment and applies sanctions penalties on a strict liability basis, and it treats a prompt report to the FBI or CISA as a significant mitigating factor. Clean offline backups keep payment from being the only option.
In most cases. According to HHS, ransomware encryption of patient data is a breach unless the covered entity or business associate demonstrates a low probability of compromise through a four-factor risk assessment, and the documentation supporting that conclusion must be retained. Counsel makes the final determination.
Your IT or security provider first, to isolate systems, then your cyber insurer’s claims line, then breach counsel, all by phone rather than company email. Report to the FBI Houston field office or IC3 as soon as practical, which also counts in your favor with OFAC if payment ever comes up.
Often, provided the logs were retained. Firewall, sign-in and file-share records can show large outbound transfers, newly installed remote access tools and unusual account activity in the days before the ransom note. Where the case requires it, a forensic firm confirms the findings.
Disconnect them instead. The CISA guide says to isolate affected systems immediately and power a device down only if it can’t be disconnected, since a machine that is shut down loses evidence held in memory. Pull the cable or isolate it with endpoint software, then leave it alone.
Call our Houston line at (281) 956-2280 and describe what you are seeing. Response is part of our managed plans and there is no published emergency rate, so the answer depends on scope, and if the case is beyond what we can take on, we’ll point you to the right next call.
Sometimes, for older strains or ones with known flaws. CISA tells victims to consult federal law enforcement about possible decryptors even while other cleanup continues, and the FBI may know of one. Run any downloaded tool against a copy of the data, never the only copy.
About 5 minutes on average across every ticket and priority, which is a measured average and not a contract promise. On managed security plans, endpoint detection can isolate an infected machine automatically, before a person has even picked up the alert.
Start Here
Find Out What Ransomware Would Hit First
Where are your backups, and could an attacker with admin rights delete them? Who has your insurer’s claims number? Which system has to come back first so you can send invoices again?
Our free network assessment starts those answers with a written map of accounts, backups and exposed systems, ranked by what would hurt most, and you keep it whether or not we ever work together.
Already hit? Call now.
Decide who pulls the cable before the ransom note shows up.
Rather call? Our Houston line is (281) 956-2280, or use the contact page.
