Ransomware at a Manufacturing Plant: Containment, Backups, and the 72-Hour Clock
At 02:14 on a Saturday, a manufacturing company's EDR alerts on 14 hosts in Plant 2 encrypting files. Within 18 minutes, 60 more hosts show ransomware notes. The ERP is still up; the backup NAS is domain-joined and uses a domain-admin service account. The last successful restore test was 14 months ago. Plant 2 produces $2.1M of revenue per day and cannot stop for more than 8 hours without contractual penalties. The incident commander has authority to isolate network segments. The cyber insurer requires notice within 72 hours; the company operates in a state with a 72-hour breach notification law if personal data is affected; HR confirms employee data may be on a file share. The CEO wants to pay the ransom if it restores operations faster; the demand is $1.8M in cryptocurrency. Legal asks you to preserve evidence.
1. What are your first five actions and in what order? Justify containment scope.
Read the worked answer
Order: (1) declare the incident and activate the IR plan with legal, communications, and executive roles; (2) isolate Plant 2 at the network layer, not by powering off hosts, to stop spread and preserve memory; (3) disable compromised domain accounts and remove the backup NAS from the domain, then take it offline; (4) preserve evidence - capture memory and disk images of representative hosts, export EDR and firewall logs, and start a chain-of-custody log; (5) verify whether ERP and Plant 1 are affected before expanding containment.
I would not shut down the entire enterprise unless lateral movement is confirmed. Production penalties are real, but containment must be evidence-based. Keep critical safety systems running. Notify the insurer and outside counsel early because the 72-hour clocks may start at awareness.
2. Evaluate the ransom decision and backup restoration options. What facts determine whether to pay?
Read the worked answer
Assume the backups are untrusted because the NAS is domain-joined with a domain-admin service account. Before considering payment, test an isolated restore from an offline copy; if the last test was 14 months ago, verify integrity and malware-free state. Ransom payment is a business and legal decision, not an IT fix: it does not guarantee decryption, may violate sanctions, may fund crime, and may not restore corrupted data.
Compare the $1.8M demand with downtime loss - $2.1M per day and contractual penalties after 8 hours - but include recovery time, reputational harm, and insurance coverage. If clean backups can meet the 8-hour RTO, restore and rebuild rather than pay. If not, the CEO and counsel decide with law enforcement input; do not negotiate unilaterally.
3. Which notifications and evidence-preservation steps are required, and what would you tell the CEO about the 72-hour clock?
Read the worked answer
Notify the cyber insurer within its 72-hour requirement, engage counsel, and contact law enforcement. Determine whether personal data was on the affected file share; if yes, the state breach law likely requires notification within 72 hours of determination, and counsel should confirm. Preserve logs, images, the ransom note, cryptocurrency wallet, and access records; do not let staff delete or 'clean' systems.
Tell the CEO that the 72-hour clock is a legal deadline, not a technical target, and that early notice can be updated. Communications should state confirmed facts, containment status, and the next update time. Avoid speculation about employee data until forensics confirms scope. The decision on paying the ransom must not delay containment or notification.