Plan on a few days to 3 weeks to get critical systems running after a ransomware attack, about 6 weeks before the business runs normally, and several months before the breach review and notices are finished. Those 3 finish lines rarely arrive together.
The ranges come from Houston companies’ own SEC filings and from the Texas Attorney General’s public breach list, which we pulled on Nov. 9, 2026, rather than from vendor surveys. If you’re already dealing with an attack, start with our ransomware incident response in Houston team, then come back to this page when you need to tell your leadership team how long the disruption will last.
Recovery time depends on which finish line you mean. Restoring core systems usually takes days to a few weeks if clean backups exist. Getting accounting, reporting and every department back to normal took ENGlobal, a Houston engineering contractor, about 6 weeks. The legal tail runs longest, and the median Houston-area notice reached the state’s public list 142 days after the breach began.
What does “recovered” mean after a ransomware attack?
Ransomware recovery is the work of restoring encrypted or damaged systems, confirming the attacker is gone, and finishing the legal and data review that follows. NIST’s Cybersecurity Framework 2.0 describes the Recover function as restoring the assets and operations an incident affected, which is a broader target than getting the servers to boot.
We find it helps to split recovery into 3 dates, because owners and insurers usually ask about different ones.
- Systems recovered, the day the applications you bill and operate from are running on clean infrastructure.
- Business recovered, the day every department, including finance and reporting, works without restrictions or workarounds.
- Incident closed, the day the forensic review is done, required notices have gone out, and the extra monitoring winds down.
Our own ransomware recovery guide for Texas says most businesses are back to normal operations within 1 to 3 weeks, and we still think that’s right for the first date. It’s too short for the second date at some firms, and nowhere near long enough for the third.
What does a ransomware recovery timeline look like?
The table below is the planning range we use with Houston clients. The phases follow CISA’s response guidance for organizations hit by ransomware, and the durations are typical ranges, not promises.
| Phase | Typical window | What sets the pace |
|---|---|---|
| Contain the attack | First hours to day 2 | How quickly someone isolates machines and disables remote access and compromised accounts |
| Find out how they got in and what they left | Days 2 to 10, often running in parallel | Log retention, and whether the forensic firm is already under contract |
| Rebuild identity and critical systems | Days 3 to 21 | Whether backups survived, and whether restores have ever been timed |
| Return every department to normal | Weeks 2 to 6, sometimes longer | Finance and reporting systems, line-of-business software, and vendor help |
| Data review and notices | 30 to 60 days from determining a breach, plus the review before that | How much personal data sat on the affected systems |
| Hardening and extra monitoring | 1 to 6 months | Insurance requirements and the gaps the investigation found |
CISA’s sequence matters for the clock. Its guidance says to look for persistence mechanisms before rebuilding, to rebuild based on the priority of critical services, and to issue password resets only once the environment has been fully cleaned and rebuilt. Restoring before that work is done can put the attacker back inside a freshly restored network, and the clock starts again.
Our guide to the first hour of a ransomware attack in Houston covers the containment steps, and the cost of each phase is covered in our incident response cost guide for Houston.
What do Houston companies’ own filings say about recovery time?
Public companies have to describe material cyber incidents to the SEC, and 3 Houston-area firms did so within 96 days of each other in 2024. Their filings are the most specific public record of how long recovery took in this market.
Halliburton became aware on Aug. 21, 2024, that an unauthorized party had gained access to some of its systems. Thirteen days later, its Item 1.05 filing said the incident was still causing disruptions and limited access to business applications, and that the response included restoration of its systems and assessment of impacted data. Its annual report for 2024 later put the cost at $35 million, including outside advisors to restore its systems.
Newpark Resources in The Woodlands detected a ransomware incident on Oct. 29, 2024. In a filing 9 days later, it said access to financial and operating reporting systems was limited, while manufacturing and field operations had continued in all material respects using established downtime procedures.
ENGlobal, an engineering contractor on the Katy Freeway in the Energy Corridor, became aware of its incident on Nov. 25, 2024. A week later its first filing said IT access was limited to essential business operations and that the timing of full restoration remained unclear. Its amended filing in January 2025 said access to business applications, including financial and operating reporting systems, had been limited for approximately 6 weeks, and that operations were now fully restored.
2 things stand out. In all 3 cases, the slowest systems to return were the business and reporting applications, not the field work. And Newpark’s line about downtime procedures shows that recovery time and business disruption are different numbers. A company can be weeks from full recovery and still be shipping product if someone wrote down how to work without the network.
Why does the breach-notice work take longer than the restore?
Because the review can’t finish until you know whose data was on the affected systems, and that usually takes far longer than restoring them. Texas law requires notice to affected people within 60 days of determining a breach occurred, and notice to the Attorney General within 30 days when 250 or more Texans are affected, as the Texas Attorney General explains. Both clocks start at that determination, not on the day of the attack.
We pulled the data behind the Attorney General’s public breach list on Nov. 9, 2026, and kept the 72 notices from Greater Houston organizations listed in the 12 months to Nov. 6, 2026. Together they covered 2,087,274 Texans. The list covers every kind of breach, not only ransomware, so read it as a guide to how long the notice process runs.
- The median time from the start of a breach to its discovery was 58 days, and 17 of 60 filers with both dates found it within a week.
- The median time from discovery to the notice appearing on the public list was 37 days, and 27 of 72 took more than 60 days.
- The median time from the start of the breach to the public listing was 142 days, and 24 of 60 took more than 180 days.
These dates are self-reported, and some filers enter the date they confirmed which records were involved as the discovery date, so a long gap isn’t proof that anyone filed late. One Sugar Land example shows the pattern. Gulshan Management Services listed its breach as running from Sept. 17 to Sept. 27, 2025, and the notice, covering 128,652 Texans, appeared on the list on March 16, 2026. Our guide to ransomware reporting rules in Houston covers who you have to tell and when.
What shortens ransomware recovery time?
Preparation does, almost entirely, and most of it costs less than a week of downtime. These are the 5 factors that move the timeline most in the cases above and in our own restore work.
- Backups the attacker couldn’t reach, with at least one locked copy held off the network and outside the Gulf Coast storm track.
- Restore times that have been measured. NIST defines the recovery time objective as how long a system can stay in recovery before the business is harmed, and that target is only real once a restore has met it.
- A clean way to rebuild identity, since Active Directory and Microsoft 365 accounts have to be trusted again before anything restored on top of them can be.
- Written downtime procedures, the kind Newpark used to keep its field operations running.
- A current map of where personal data lives, which can cut weeks off the review that decides who gets a notice.
For the systems a Houston business can’t operate without, our backup and disaster recovery service in Houston starts from a target of under 4 hours, then inside 1 business day for the next tier, and a few days for archives. Our Fully Managed IT plan restores real data every quarter and records how long the restore took, so the target in the plan is a measured number before anyone needs it.
Paying the ransom is sometimes described as the fast option, but it doesn’t skip most of this list. NIST’s ransomware profile treats recovery planning as its own set of outcomes, and a decryption key does nothing about the attacker’s persistence, the credential resets or the notices.
How should a Houston business plan its own recovery timeline?
Write the timeline down before you need it, with a date for each of the 3 finish lines and a name next to each step. A plan that fits on 2 pages and has been read by the people in it is worth more than a long document nobody has opened.
- List your systems in recovery order, starting with whatever you invoice, pay people and serve customers from.
- Time a full restore of the first tier, and write the result into the plan instead of the target.
- Write the downtime procedure for each department, including how orders, payroll and approvals happen on paper.
- Note where personal and customer data is stored, so the breach review starts with a map.
- Put the phone numbers for your incident response firm, insurer and outside counsel in the plan, and keep a printed copy away from the network.
NIST’s incident response guidance, SP 800-61 Revision 3, puts preparation inside the same cycle as response and recovery, and the Houston filings above make the same point in practice. The businesses that recovered faster had decided ahead of time how they would work while systems were down.
What Houston owners ask about ransomware recovery time
How long does it take to recover from ransomware?
Most businesses get critical systems back within a few days to 3 weeks if clean backups survive. Full business recovery took about 6 weeks at one Houston contractor, and breach review and notices can run for months after that.
Can we get our systems back in 24 hours?
For a handful of critical systems, sometimes, if you have tested backups the attacker couldn’t reach and a rehearsed restore. Rebuilding the whole environment in a day is rare, because CISA’s guidance calls for checking for persistence before restoring anything.
Why did our restore finish but the incident isn’t over?
Restoring systems is one finish line, and the forensic review and notices are another. Texas starts the 60-day individual notice clock and the 30-day Attorney General clock when you determine a breach happened, and confirming whose data was involved often takes weeks.
Does paying the ransom make recovery faster?
Not by much. Even with a working key, you still have to remove the attacker’s access, rebuild trust in user accounts, reset credentials and complete any required notices, and decrypting large volumes of data can be slow.
How long should we keep extra monitoring in place?
Keep it for at least 30 to 60 days after systems are restored, and longer if the investigation never confirmed how the attacker got in. Many cyber insurers also set their own requirements before renewal.
What is a realistic recovery time objective for a small Houston business?
Start with under 4 hours for the few systems that stop revenue, 1 business day for the next group, and several days for archives. Those numbers are planning targets until a timed restore shows you can hit them.
Send us a list of your critical systems and we’ll show you, in writing, how long each would take to restore today, where the slow points are, and what it would take to shorten them. We usually reply within 5 minutes.
Talk to a Security ExpertPrefer email or a phone call? Reach the team through our contact page.
