Ransomware at 03:40 on a Plant Floor
At 03:40 on a Sunday, the SOC at a 2,300-endpoint manufacturer saw EDR quarantine two ransomware detonations and one file server begin encrypting. By 04:10 three file servers were encrypted, a ransom note pointed to a leak site, and the attacker had used a domain administrator account created nine days earlier. The plant runs 24/7; a full stop costs about $180,000 per hour. Backups are nightly to tape, shipped offsite; the newest tape is 26 hours old. Volume snapshots exist but sit on the same NAS that is being encrypted. EDR is not deployed on the OT network, which shares a domain trust with IT. Cyber insurance requires notification within 72 hours, and state law requires breach notice if personal data was accessed. The CEO asks whether to isolate OT and whether to restore from tape immediately.
1. Set the priorities for the first two hours and justify the order, including what you do about the OT network.
Read the worked answer
Declare an incident and give the incident commander authority first, because the plant, IT, and communications teams will otherwise act in parallel. Then contain identity before hosts: disable the nine-day-old domain admin and any sessions it created, reset privileged credentials, and plan a double krbtgt reset because a domain admin for nine days likely means Golden Ticket capability. Isolate the three encrypted servers, but do not power them off; memory holds the encryption keys and the execution path. Preserve evidence early, since logs and memory are perishable.
On OT, isolate now. The shared domain trust means IT compromise is a path to the plant, and EDR is absent there, so prevention is network-level: break or firewall the IT-to-OT path, block domain authentication from OT to compromised domain controllers, and coordinate with plant operations before changing anything that could trip a safety system. Safety of people and physical process outranks evidence and even recovery speed. The order is: command and scope, identity containment, IT host containment and evidence, OT isolation, then recovery planning. Restoring from tape at 04:30 would be premature because the attacker may still hold credentials and the clean scope is unknown.
2. Decide whether to restore from the 26-hour-old tape now. Explain the conditions you would require first.
Read the worked answer
Do not restore yet. A 26-hour-old tape was written while the attacker had domain admin, so it may contain compromised system state, malicious scheduled tasks, or credentials that allow re-infection; and restoring into a still-compromised domain simply re-encrypts the data. The snapshots on the same NAS are not a recovery option because they are in the encryption path.
Conditions before restore: confirm the attacker's access is removed, including all domain admin accounts, service accounts, and persistence such as scheduled tasks and GPO changes; rebuild the three servers from known-good images rather than restoring system state, then restore data only from tape; validate tape integrity by restoring to an isolated network and scanning and testing before promotion; rotate every credential that could have been exposed, including backup service accounts, because the backup system is a prime target; and deploy EDR or equivalent monitoring on restored hosts before they rejoin production. Also verify the tape's catalog and chain of custody. The business pressure to restore is real at $180,000 per hour, so run the isolated validation in parallel with containment and give the CEO a realistic timeline rather than an unsafe shortcut.
3. Map the notification obligations and sequence them, explaining what drives timing.
Read the worked answer
Timing is driven by three clocks plus one contractual clock. The insurance policy's 72-hour notice is contractual and starts now; call the insurer early because they may supply forensics and counsel, and late notice can jeopardize coverage. The state breach law clock starts when you determine that personal data was accessed or acquired, not when the encryption began; you may not be able to make that call for days, so document the investigation timeline and involve outside counsel for privilege. Law enforcement notification is voluntary but worth doing early through the FBI or IC3, especially with a leak site, and it can support ransom-payment sanctions screening. Customer notification follows confirmed data exposure and legal review, not rumor.
Sequence: insurer and counsel within hours, law enforcement within 24 to 48 hours, regulator within the statutory window once the personal-data determination is made, and customers after scope is confirmed. If the company is public, coordinate materiality assessment with counsel for securities disclosure. Do not let notification deadlines force a premature 'no breach' statement; issue factual updates and preserve the option to supplement.