Report a ransomware attack once to the FBI, CISA or the Secret Service, because they pass it along, then call your insurer and a lawyer before anyone makes a legal decision. Texas adds its own clocks. Affected people hear within 60 days, and the Attorney General hears within 30 days when 250 or more Texans are involved. Our cybersecurity services in Houston cover the technical side.
Report a ransomware attack to the FBI through ic3.gov or its Houston field office, and that one report also reaches CISA and the Secret Service. Then notify your insurer, and file Texas breach notices if sensitive personal information was taken.
I’m the CTO at Uprite. When a ransom note is sitting on a screen, the question about who to tell shows up inside the first 10 minutes. Usually right after someone asks whether the backups survived. Fair order, honestly.
People want one answer. There isn’t one. There are 4 separate jobs here, and each has its own clock. Law enforcement has no deadline but wants you early. Your insurer has a policy clock. Regulators, and the people whose data was taken, have clocks written into statutes, and your biggest customer may have one buried on page 14 of a contract nobody has read since signing.
This post covers the first three, with the Houston details. I’m not a lawyer. Counsel makes the final call on what you owe. For the rest of the plan, our guide to a data breach response plan for Texas businesses picks up where this one stops. For who runs the response itself, see our incident response services in Houston.
Who should you report a ransomware attack to first?
You report a ransomware attack to your cyber insurer and to federal law enforcement first. The FBI, CISA and the U.S. Secret Service all take reports, and CISA says a victim only needs to report once to have the other agencies notified. Call the insurer before you hire anyone, because the policy may decide who you’re allowed to hire.
CISA’s wording is blunt. On its ransomware reporting page it says every ransomware incident should be reported to the U.S. government. No federal law makes most Houston businesses do that today, and that’s exactly why plenty of them don’t.
Will it get your files back? Rarely. Anyone who promises that is selling something. What a report does is put you on record early, with a case number, and that matters a great deal later when your insurer, a regulator or a lawyer asks what you did and when. Early is the point.
| Route | Where you file | What it’s good for | Houston detail |
|---|---|---|---|
| FBI Internet Crime Complaint Center | ic3.gov | A written complaint that creates a record | Goes to the FBI for review and follow-up |
| FBI Houston Field Office | 1 Justice Park Drive, Houston 77092, (713) 693-5000 | An attack that’s still unfolding | Tips line runs around the clock |
| CISA | cisa.gov, online report form | Technical help and a federal record | One report reaches the other agencies |
| U.S. Secret Service | Field office finder on secretservice.gov | Another door into the same federal system | Use it if you already know an agent |
Pick one door. Filing 4 times just creates 4 versions of your story.
What should an FBI ransomware report include?
The FBI’s own list has 9 items. In a public service announcement it asked victims to report each of these, regardless of how the incident ended.
- The date the infection started
- The ransomware variant, if the note names one
- Basic details about your company
- How you think the attacker got in
- The ransom amount demanded
- The attacker’s Bitcoin wallet address
- Any ransom you paid
- Your total losses so far
- A short statement of how the attack hurt the business
Nobody expects all 9 at hour 2. Send what you know.
Screenshot the ransom note before anyone touches the machine, since the wallet address and the variant name both live in it. Then leave the machine powered on and off the network. That advice comes from our own incident work. If an owner remembers one thing from this post, I’d pick that. Simple, and it gets skipped constantly.
When does Texas law require you to report a ransomware attack?
Texas requires a breach notice when sensitive personal information was acquired without authorization, no later than the 60th day for individuals and no later than the 30th day for the Attorney General when 250 or more Texans are affected. Both clocks run from the day you determine a breach occurred.
That date is yours to set and yours to defend. Write it down. Note who decided and what they knew. Our Texas breach response plan walks through how to scope it in the first 72 hours.
The 30-day Attorney General clock is newer than people think. Senate Bill 768 cut it from 60 days, and the bill text took effect September 1, 2023. Notice goes in through an electronic form on the Attorney General’s site, and the office’s own instructions carry a few warnings I’d pass along.
The form saves no drafts. Finish it in one sitting. One back click wipes it. And because the completed report is potentially an open record, anyone can ask for a copy, so write it as though a reporter will read it. A second breach needs a second report, and an update has to show the total number of people affected and notified to date.
Two more pieces sit in the statute. Under Section 521.053, when more than 10,000 people are notified at once the nationwide consumer reporting agencies hear about it too, and skipping notice isn’t free, since Section 521.151 allows a penalty of up to $100 per person per day, capped at $250,000 per breach.
Not every incident is a breach. Here’s the honest wrinkle. Texas has no HIPAA-style presumption that encrypted files count as stolen. Whether an encryption-only attack triggers notice is a legal question about acquisition, and forensics, not the ransom note, tells you whether data was actually copied. So the investigation comes first. Filing comes after.
What does the Texas Attorney General’s breach list show?
The Attorney General must post every notice it receives, so the list works as a public record of how Texas businesses actually handle the clock. It’s open to anyone. I pulled it on October 29, 2026. It holds 682 notices published in the previous 12 months, and 279 came from Texas-based organizations.
Greater Houston accounts for 77 of those, which I counted by filer city, including Houston itself with 50, plus Spring, Conroe, Deer Park, Sugar Land, The Woodlands and a few smaller cities. Together they cover 2.14 million Texans. One filer, CenterPoint Energy, accounts for 970,891 of them, so the median is the fairer number. The median Houston-area notice involved 2,462 Texans, and 28 of the 77 involved fewer than 1,000.
The timing is the part I’d read twice. The median gap between the discovery date a filer entered and the day the Attorney General listed the notice was 40 days. Some 253 notices, or 37%, were listed more than 60 days after the entered date, and only 218 were listed within 30. That isn’t a measure of lateness, because the office has up to 30 days to post after it receives a notice and some filers enter the date they finished working out whose data was involved. It does show how much weight the date you choose carries.
Social Security numbers appear in 566 of the 682 notices. That’s 83%. October is already the busiest month in the window, with 87 listings so far against 77 in September. The list doesn’t say which incidents were ransomware, so I can’t tell you how many were. Anyone who says they can is guessing.
Which other reporting rules might apply to your business?
Several federal rules sit on top of Texas law, and which ones apply depends on what you do, not how big you are. A medical practice, a mortgage broker, a public company and a defense supplier can all be hit by the same ransomware strain and owe 4 different notices. Same attack. Four sets of paperwork.
| If you are | Who you tell | Clock | Rule |
|---|---|---|---|
| A medical or dental practice | Affected people, HHS, and the media at 500 or more | Without unreasonable delay, 60 days at most | HIPAA Breach Notification Rule |
| A CPA firm, mortgage broker or similar financial business | The FTC, on its online form | 30 days after discovery, 500 or more consumers | FTC Safeguards Rule |
| A public company | The SEC | 4 business days after deciding the incident is material | Form 8-K Item 1.05 |
| A defense contractor with covered defense information | The Department of Defense, through DIBNet | 72 hours from discovery | DFARS 252.204-7012 |
| Any business holding sensitive data on 250 or more Texans | The Texas Attorney General, then individuals | 30 days and 60 days | Business and Commerce Code 521.053 |
| A critical infrastructure company, once the rule takes effect | CISA | 72 hours for an incident, 24 hours for a ransom payment | CIRCIA |
Healthcare first. HHS treats ransomware that encrypts patient data as a presumed breach, in its ransomware fact sheet, unless a documented four-factor assessment shows a low probability that the data was compromised. Our HIPAA cybersecurity services in Houston page covers how that assessment gets done.
The FTC rule catches businesses people forget are financial institutions. Tax preparers and mortgage brokers are on the FTC’s list. Its notification requirement took effect May 13, 2024, and our post on IRS cybersecurity requirements for Houston CPAs sorts out who enforces what.
Public companies file on a different track. From December 2023 through September 26, 2026, I counted 84 Item 1.05 filings from 58 companies nationwide, and the only 2 in the energy sector, Halliburton and ENGlobal, are both Houston companies, which says something about where the region’s disclosed incidents cluster. The detail is in our look at ransomware targeting Houston energy companies.
Defense suppliers have the shortest clock, and it’s the one people miss. Reports go through DIBNet, which needs a DoD-approved medium assurance certificate. The 72 hours don’t pause while you apply for one. Get the certificate now. Our CMMC compliance in Houston page covers the rest of that world.
What is CIRCIA, and does it apply to you yet?
CIRCIA is the federal law that will make critical infrastructure companies report significant cyber incidents to CISA within 72 hours and ransom payments within 24 hours, and its final rule isn’t in effect yet. Until it is, federal reporting stays voluntary for most private businesses.
The timeline keeps slipping. According to a law firm summary on Inside Privacy, CISA sent the draft final rule to the White House Office of Information and Regulatory Affairs on October 1, 2026. That review can run up to 90 days, and the rule likely won’t take effect until at least 60 days after it’s published in the Federal Register. The text isn’t public. The final scope could still change.
My view is simple. If you’re in a critical infrastructure sector, which here means a lot of energy and healthcare companies, build your response plan around the 72-hour clock now. Rewriting it under pressure later costs more. Plans written at 2 a.m. are bad plans.
Should you tell your insurer, and what about paying the ransom?
Tell the insurer first. Many cyber policies set a notice window and name the forensic and law firms they’ll pay for, and spending money before you call can put coverage at risk. Call first. Read the notice window today, not during the incident. Our guide to the cyber insurance application shows what carriers ask.
Paying is a different question, and I won’t answer it for you here. The FBI doesn’t support paying a ransom. A lawyer, your insurer and the facts decide it. But there’s a reporting angle most owners never hear about.
Paying a ransom to a sanctioned party can violate U.S. sanctions, and OFAC can penalize on a strict liability basis, which means you don’t have to know who the payee was. That’s harsh. Its September 2021 advisory says a self-initiated, timely and complete report to law enforcement, along with full cooperation, counts as a significant mitigating factor. The advisory is guidance, not law. It’s still the best argument I know for reporting early. If recovery is the goal, our ransomware recovery guide for Texas covers the restore side.
In what order should you make the calls?
Insurer first, even while you’re still scoping. Counsel second, and run the rest of the response through them. The FBI the same day, through ic3.gov or the Houston office. Then come the contract notices, since a customer agreement can set a clock shorter than any statute, and after that the regulators, each on their own deadline, with the date you determined a breach occurred written down where counsel can find it.
That order isn’t a law. It’s what I’d do. It keeps your options open, which is the whole idea. Nothing exotic. Before any of those calls, our guide to what to do in the first hour of a ransomware attack covers the first 60 minutes.
Where Uprite fits, and where it doesn’t
We’re a managed IT and security provider. We aren’t a law firm. We don’t file the reports for you either, since the owner or counsel has to sign them. That’s the line. What we do is contain the incident, preserve the evidence, and build the technical timeline that makes every one of these reports accurate, and our teams work from Houston, San Antonio, Dallas and Katy, so someone can reach the rack when a switch has to be pulled by hand.
For prevention, see ransomware protection for Houston businesses.
Questions Houston owners ask about reporting ransomware
Do I have to report a ransomware attack to the FBI?
Federal law doesn’t make most private businesses report ransomware to the FBI, though CISA says every incident should be reported. Regulated businesses, public companies and defense suppliers have separate mandatory rules. Reporting is free. OFAC treats it as a mitigating factor. Report anyway.
How long do I have to notify the Texas Attorney General?
30 days from the date you determine a breach occurred, when 250 or more Texans are affected. Individuals must hear within 60 days. Both run from the same date. Write it down on purpose and keep the reasoning with it.
Who do I call first, the FBI or my insurer?
Call your insurer first, then counsel, then the FBI the same day. Policies often set notice windows and name the vendors they’ll pay for, so a late call can cost coverage. Order matters.
Does paying the ransom mean I don’t have to report?
Paying a ransom doesn’t cancel any notice duty. A public company still files the 8-K, and Texas notice depends on whether sensitive personal information was acquired, not on whether you paid. Paying can also bring sanctions risk, so counsel should be involved first.
What if the attackers only encrypted files and stole nothing?
Texas notice may not be triggered if no sensitive personal information was acquired, but a HIPAA-covered practice must presume a breach unless a documented assessment shows a low probability of compromise. Forensics settles which side of that line you’re on, and counsel makes the call. Don’t decide from the ransom note alone.
Is the CIRCIA 72-hour rule in effect yet?
Not yet, because CISA’s final rule is still at the White House for review. It went there on October 1, 2026, and it won’t bind anyone until it’s published and takes effect, likely at least 60 days later. Treat it as the target your plan should already meet.
Get the reporting order written down before you need it. We’ll walk your team through who gets called, in what order, with the contacts and clocks that fit your insurer, your regulators and your contracts, then hand you a plan that’s yours to keep either way.
Get an Incident-Readiness Assessment
