Ransomware at 02:10: the kiln, the backups, and the 72-hour clock

Hour 0-1: declare and stabilise the decision structure. Declare major incident, name an incident manager with authority to spend and to stop systems, open one timestamped log. Do not restore yet. Establish three facts that change everything downstream: is the actor still active, what is the real blast radius, and is exfiltration evidenced or merely claimed.

Hour 1-2: contain without destroying the forensic picture. Isolate encrypted and quarantined segments at the network layer, disable compromised privileged accounts, revoke VPN sessions, rotate the two or three credentials that matter most - backup, hypervisor, domain recovery. Preserve memory images from two representative hosts before reboot if feasible, export EDR telemetry, retain the ransom note and any attacker communications with hashes, and secure firewall and proxy logs covering the exfiltration window. Restoring over encrypted hosts destroys the evidence of how they entered, which is what prevents round two.

Hour 2-4: answer the restoration question honestly. A 26-hour-old restore point means reconstructing a day of transactions from paper, EDI acknowledgements or plant logs. Test-restore one non-critical system first, and verify the backup estate itself is not compromised - backup catalogue credentials are a standard target. Rebuild rather than restore onto suspect hosts.

Hour 4-6: the decisions that cannot wait - OT and kiln, the regulatory clock, and a holding statement with one spokesperson. The CEO's absence is a reason to invoke documented delegated authority, not to wait.

Rule. Record every decision, its owner, and the information available at the time. That record protects individuals later.

The kiln is a safety and physical-asset decision, not an IT decision. Cooling takes 12 hours and cannot be compressed; cutting power risks the refractory lining, a loss above EUR 2m, and potentially personnel safety. The IT/OT firewall is only as strong as its weakest path, and a vendor laptop on both segments is exactly that path.

Actions:

• Treat the vendor laptop as probable patient zero: locate, isolate, image it, and pull its connection logs. Ask the vendor for the engineer's itinerary and software version.
• Verify the OT firewall rule set as configured, not as designed - look for any-any rules, shared services, or remote-support tunnels that bypass segmentation.
• Do not power down Plant 3. Run the kiln on its local control system with the OT network isolated from IT, physically if necessary, and staff it.
• Suspend all vendor remote access group-wide and require out-of-band approval for any new connection; the same support contract probably covers all six plants, so the path must close everywhere at once.

Residual risk. The plant director plus the safety officer explicitly accept the risk of continuing the burn, documented in writing. If the kiln is damaged, the post-incident question will be whether the decision was deliberate and made by the right person - not whether it was made.

Reasoning. Containment that creates a safety incident is not containment. The correct move is to segment harder around OT, not to shut it down.

Facts that gate the 72-hour GDPR clock: is personal data actually involved - employee, customer, supplier contact - and is there a risk to rights and freedoms? '400 GB exfiltrated' is an attacker claim, not evidence, and in the first 24 hours you will rarely know. Start the assessment and the notification drafting in parallel rather than waiting for certainty: the clock runs from awareness of a likely breach, and a late notification is a separate violation.

Who decides. Legal and compliance own the notification decision and its wording; the incident manager supplies the factual basis; the board or a delegated director is informed rather than asked to adjudicate technical facts. If the data set is still unclear at hour 60, notify on what is known and update. Regulators generally accept phased notification; they do not accept silence.

Insurer and ransom. The breach coach's job is to reduce loss, which does not make negotiation the default. Any negotiation requires: legal advice on sanctions exposure, since paying a sanctioned entity can be a criminal act; a written board-level decision; law-enforcement engagement where required; and a realistic test of whether keys work - decrypt one file before paying anything. Never negotiate from infrastructure attributable to the company.

Communications. One spokesperson, one holding statement, no speculation about data volumes. Employees need a script before customers call. Eight hours of silence in a ransomware event is itself a reputational decision.

Consistency test. What you tell the regulator, insurer, clients and staff must be reconcilable. Maintain a single fact sheet with explicit confidence levels.