When ransomware is active in your environment, the most damaging decision you can make is spending the first hour trying to figure out who to call.
Every minute between detection and expert engagement is additional encryption across your environment. The attacker has already had days or weeks in your network. The preparation they completed during that time, mapping your environment, compromising your backup infrastructure, escalating privileges across your domain, is already done. What happens now depends on how fast qualified help is engaged and how well the response is executed from the first minutes.
This article tells you exactly who to call, in what order, what each resource provides, and what to do while you are waiting for external help to arrive. If you are reading this during an active incident, skip to the sequence below and start executing.
The Emergency Contact Sequence
The order in which you engage external resources matters. Contacting resources in the wrong order creates delays, affects coverage decisions, and in some cases creates legal exposure that the correct sequence avoids.
First Call: Your Cyber Insurance Provider
Call your cyber insurance carrier’s emergency line before engaging any other external resource. This is the call most organizations make third or fourth, and making it later creates coverage problems that cannot be undone.
Most cyber insurance policies require prompt notification following a covered event. Policies that condition coverage on notification within a defined timeframe begin that clock at discovery. Costs incurred before insurer notification, including cybersecurity services vendor fees, may not be covered if the policy required prior notification or prior approval for vendor engagement.
The insurer’s emergency line provides immediate access to a breach coach, typically legal counsel with cybersecurity incident expertise, who coordinates the response and ensures that subsequent decisions are made in a way that preserves coverage. The breach coach engagement, the approved incident response vendor list, and the coverage authorization for emergency response expenditures are all initiated by this first call.
What you need for this call: your policy number, the emergency reporting line number, and a brief description of what you are observing. You do not need a complete damage assessment before making this call. Call now and update as you learn more.
Where to find this information if you do not have it memorized: it should be in your incident response plan in a location accessible without production system access. If that information is in your email system and your email system is affected, you have an information access gap that must be addressed after this incident. For now, check printed documents, physical files, or personal mobile devices where emergency contacts may have been saved.
Second Call: Legal Counsel
Legal counsel with cybersecurity incident expertise must be engaged in the first hour. The legal dimension of a ransomware event begins at discovery, not after recovery, and decisions made in the first hours without legal guidance create exposure that cannot be undone.
The specific legal work that begins immediately includes assessment of regulatory notification obligations and their timelines, review of the payment decision if it becomes relevant including OFAC sanctions screening of the attacker group, management of privilege protection for the forensic investigation, and coordination of communications with affected parties, regulators, and the media.
If your cyber insurance carrier’s breach coach is legal counsel, that engagement may satisfy this requirement. Confirm with the breach coach whether they are providing legal counsel to your organization or coordinating the response on behalf of the insurer, because those are different relationships with different privilege implications.
If you do not have pre-established legal counsel with cybersecurity expertise, your cyber insurance carrier’s breach coach is your immediate resource. Engaging independent legal counsel in addition to the breach coach, particularly for highly regulated industries including healthcare, financial services, and defense contracting, provides additional legal coverage that the breach coach relationship may not supply.
Third Call: An Incident Response Firm
Professional incident response support is the technical resource that contains the attack, preserves forensic evidence, conducts the investigation, and manages the recovery. This is the call that most organizations make first. Making it third, after insurance and legal, ensures that the engagement does not create coverage problems and that privilege protection for the investigation is structured correctly before the forensic work begins.
Your cyber insurance carrier will provide a list of approved incident response vendors. Engaging a vendor from the approved list is a policy condition in most cyber insurance arrangements. Engaging a vendor not on the approved list without prior insurer authorization may result in those costs being uncovered or only partially covered.
If your incident response vendor relationship was established before the incident as part of your preparedness program, confirm with your insurer that the pre-established vendor is on the approved list. If they are, proceed with engaging them and notifying the insurer simultaneously. If they are not, the insurer’s approved vendor must be engaged for covered costs even if you use your preferred vendor in parallel.
What professional incident response firms provide during an active ransomware event includes containment support and guidance, forensic evidence preservation, malware analysis and variant identification, investigation of the entry point and lateral movement, threat elimination validation, recovery sequencing and support, and regulatory compliance documentation support.
The response timeline for engaging an incident response firm from first contact to active support varies. Established firms with retainer arrangements can have remote support active within an hour and on-site support within hours to a day. Firms engaged without a prior retainer may take longer to mobilize. This is one of the most operationally significant arguments for establishing an incident response retainer before an incident.
Fourth Call: Law Enforcement
Report the incident to the FBI Internet Crime Complaint Center at ic3.gov. This report is recommended for all ransomware incidents and is required in some regulated industries. Filing the report does not slow your recovery, does not require you to share information you are not prepared to share, and initiates law enforcement awareness that may provide threat intelligence about the attacker group relevant to your response decisions.
For defense contractors with DFARS 252.204-7012 obligations, the law enforcement notification requirement is embedded in the regulatory notification obligation. The DIBNet report to DoD must be filed within 72 hours of discovery and satisfies the law enforcement notification requirement for those contractors.
For healthcare organizations, financial services organizations, and others in regulated industries, separate law enforcement notification to the FBI IC3 supplements rather than replaces regulatory notification obligations.
What law enforcement can provide during an active incident includes threat intelligence about the specific ransomware group, information about whether the group is subject to OFAC sanctions that affect the payment decision, and in some cases access to decryption keys recovered through prior law enforcement operations against the same group. Law enforcement cannot and does not manage your technical recovery, but the intelligence they can provide is operationally relevant.
Where to Find Incident Response Support
If you do not have pre-established incident response relationships and need to find qualified support during an active incident, the following resources provide legitimate access to professional incident response capability.
Through Your Cyber Insurance Carrier
Your cyber insurance carrier’s emergency line is the fastest path to approved incident response support if you do not have a pre-established relationship. The carrier’s approved vendor panel includes firms that have been vetted for incident response capability and that have established pricing and engagement terms with the insurer. The breach coach who coordinates the response will initiate the approved vendor engagement as part of their role.
Direct Engagement of Established Incident Response Firms
Established incident response firms maintain 24/7 emergency response capability for organizations that engage them directly. Firms with established ransomware response practices include major cybersecurity consulting firms and dedicated incident response specialists. When engaging directly without insurance coordination, confirm the firm’s ransomware-specific experience, their response time commitment, and their on-site mobilization capability for your location.
Verify that any firm you engage is legitimate before providing them access to your environment. During high-profile ransomware incidents, fraudulent recovery services that are actually additional malware have appeared. Engage firms you can verify through established references, recognized industry presence, or insurance carrier approval.
Through Your Managed IT or Security Provider
If you have a managed IT or managed security service provider relationship, contact them immediately. Your managed provider may have incident response capability directly or may have established referral relationships with incident response specialists. Providers with 24/7 security operations capability can initiate remote containment support and engage their incident response resources faster than a cold engagement with an unfamiliar firm.
The limitation of relying on your managed provider for incident response is that the provider’s access to your environment may itself be a factor in the incident if supply chain compromise is involved. Confirm with the provider whether their infrastructure or access credentials may have been affected before granting them additional access during the response.
Government Resources
The Cybersecurity and Infrastructure Security Agency maintains resources for ransomware response including the StopRansomware.gov portal, which provides guidance, resources, and the option to report ransomware incidents. CISA does not provide direct incident response services to private organizations but can provide threat intelligence and connect organizations to appropriate resources.
For critical infrastructure sectors including healthcare, financial services, energy, and transportation, CISA has sector-specific liaisons who can be engaged through the StopRansomware.gov reporting mechanism or through direct contact with CISA’s 24-hour operations center.
The No More Ransom project at nomoreransom.org provides free decryption tools for specific ransomware variants and the Crypto Sheriff identification tool. This is a technical resource for decryption tool access, not an incident response service, but it should be checked early in the response to determine whether a free recovery path exists for your specific variant.
What to Do While Waiting for External Help
External help takes time to mobilize even when it is engaged immediately. The actions your internal team takes in the period between detection and external support arrival determine how much additional damage occurs during that window.
Execute Immediate Containment
Network isolation of confirmed-infected systems should begin immediately without waiting for external guidance. Physically disconnect network cables from infected endpoints. Disable wireless access points serving affected areas. Suspend vendor remote access connections. Disable VPN and remote desktop infrastructure.
These actions require no specialized expertise and produce immediate benefit by stopping the spread of ransomware to additional systems. The instructions for executing them in your specific network environment should be in your incident response plan. If they are not, execute the most direct available action: pull cables, disable APs, and restrict external access through whatever controls are immediately available.
Do not shut down infected systems. Preserve volatile memory by keeping infected systems powered on while network-isolated.
Establish an Out-of-Band Communication Channel
If your normal communication infrastructure may be affected by the incident, establish a communication channel that does not depend on it. Personal mobile phones, personal email accounts, and pre-established external messaging platforms provide communication capability that does not depend on potentially compromised organizational infrastructure.
Coordinate the entire response team on this out-of-band channel from the beginning of the incident. An attacker who has access to your organizational communication infrastructure can monitor your response coordination if you continue using it.
Begin Evidence Preservation
While waiting for the incident response firm, begin collecting the basic evidence that requires no specialized tools. Photograph ransom notes displayed on screens. Screenshot affected file directories showing encrypted files. Document which systems are confirmed infected and when each was identified. Capture timestamps of every action taken since detection.
This basic documentation takes minutes and produces evidence that supports the forensic investigation, the insurance claim, and the regulatory compliance documentation regardless of when the professional forensic team arrives.
Do Not Attempt Remediation Without Professional Support
The containment actions described above are appropriate for your internal team to execute immediately. Remediation actions including wiping systems, restoring from backup, or running decryption tools should wait for professional incident response support.
Remediation actions taken before threat elimination is confirmed produce reinfection. Restoration initiated before the full infection scope is identified restores systems into a still-compromised environment. Decryption tool execution on systems that still contain active ransomware can produce re-encryption of decrypted files.
The period between detection and professional support arrival is the time for containment, documentation, and the emergency contact sequence. It is not the time for remediation.
What to Tell Your Team
Your internal team needs direction immediately. Without clear guidance, employees will make decisions about what to say to customers, how to handle affected systems, and what information to share externally that create legal and operational problems.
The guidance your team needs right now:
- Do not attempt to fix affected systems individually.
- Report all affected systems to the IT response lead immediately through the out-of-band communication channel.
- Do not connect personal devices to the organizational network as a workaround.
- Do not discuss the incident on social media or with external parties.
- Refer all customer and media inquiries to the designated response team contact without characterizing what is happening.
- Continue performing job functions through any available manual or alternative processes.
This guidance should be communicated through the out-of-band channel, not through organizational email or collaboration platforms that may be affected. If you cannot reach all employees through available channels, prioritize the employees in customer-facing roles and those with IT access who might take independent remediation actions.
What Information to Have Ready for Your First Calls
When you make the emergency contact calls, the following information will be requested. Having it ready reduces the time spent on each call.
For the cyber insurance carrier: policy number, organization name, description of what you are observing, approximate number of affected systems if known, and whether you believe customer or employee data may be involved.
For legal counsel: same basic incident description, the industries and states where your customers are located (relevant to breach notification obligation assessment), and whether you are in a regulated industry with specific notification requirements.
For the incident response firm: organization size and location, type of environment including cloud, on-premises, or hybrid, approximate number of affected systems, the ransom note text or screenshot if available, the ransomware variant if identified, and your backup infrastructure status.
Having this information ready before making calls reduces call time and accelerates the engagement process.
Meet Our CEO, Matt Rosenthal
With more than 30 years of experience in business and technology leadership, Matt Rosenthal has guided organizations across healthcare, finance, legal, manufacturing, and defense through active ransomware events and the preparation investments that determine how those events resolve. As President and CEO of Mindcore Technologies, Matt leads a team that provides emergency ransomware response support and the ongoing managed IT and cybersecurity services that reduce ransomware risk before an incident requires emergency response.
If your organization is in an active ransomware incident right now, contact Mindcore immediately. Engagement speed matters. The response infrastructure Mindcore provides is designed to be operational within hours of first contact.
Frequently Asked Questions
What if our cyber insurance emergency line is not answering?
If you cannot reach the primary emergency line, try the carrier’s general customer service line and escalate to emergency response. Try the agent or broker who placed the policy, who will have alternative contact information for the carrier’s incident response team. Document every attempt to notify the carrier including timestamps, because demonstrating good-faith notification efforts matters for coverage even when initial contact is delayed by carrier availability issues.
Should we notify customers before we know the full scope of the incident?
Not yet. Customer notification during an active incident requires legal review before any external statement is made. Premature notification that proves inaccurate when more complete information becomes available creates additional legal exposure and damages customer trust more than accurate notification provided after the initial assessment is complete. Legal counsel will advise on notification timing and content based on applicable regulatory requirements and the specific facts of the incident.
What if we cannot afford professional incident response services?
Engage your cyber insurance carrier first, because covered incident response costs are the most accessible path to professional support regardless of your organization’s immediate liquidity. If you do not have cyber insurance, contact CISA through StopRansomware.gov and the FBI IC3, both of which can connect organizations to available resources. Some incident response firms offer flexible engagement terms for organizations that cannot pay standard emergency rates, particularly for non-profit and healthcare organizations. The cost of professional incident response is consistently lower than the cost of an unmanaged recovery.
How do we know the incident response firm we are engaging is legitimate?
Verify the firm through sources independent of the firm itself: check their established industry presence through recognized cybersecurity industry publications and organizations, verify their references from previous clients, confirm their listing on your cyber insurance carrier’s approved vendor panel, and validate their contact information against their established website rather than contact information provided through an unsolicited approach. Do not engage firms that contacted you unsolicited following public reporting of your incident, as fraudulent recovery services have used this approach.
Should we tell our employees what happened?
Yes, with guidance from legal counsel on the content and timing of internal communication. Employees need enough information to follow the response protocols, avoid actions that complicate the response, and handle customer inquiries appropriately. They should not receive more detail than they need to perform those functions, and all information shared internally should be treated as potentially discoverable in subsequent legal proceedings. Legal counsel should review internal communication content before it is distributed.
Contact Mindcore Now If You Are Under Attack
If ransomware is active in your environment, contact Mindcore immediately. Provide your organization name, location, and a brief description of what you are observing. The response engagement begins with first contact.
Mindcore’s cybersecurity services and managed IT services provide emergency ransomware response support for organizations across healthcare, finance, legal, manufacturing, and defense. The response infrastructure is designed to mobilize within hours of first contact and to provide the containment, forensic, and recovery support that the first 24 hours of a ransomware event require.
If you are not in an active incident and want to ensure your organization is never in the position of searching for emergency help under attack conditions, contact Mindcore to establish the incident response relationships, backup infrastructure, and security controls that make emergency response a planned capability rather than a crisis search.
