Ransomware With Partial Backups and Three Reporting Clocks
You are CISO of a US-listed medical-device manufacturer with EU operations in Germany and Poland. At 02:14 on a Thursday the SOC confirms ransomware across 1,800 Windows endpoints and 60% of servers. The ERP and the file shares backing it are encrypted; the immutable object-storage backups, covering about 60% of systems including finance and HR, are intact. Investigation shows 800GB exfiltrated over six days, including EU customer contact data of roughly 120,000 individuals and employee occupational-health records. The note demands $6.5m in Monero within 72 hours and threatens publication. Three plants are idle; order fulfilment is manual and degrading. The CEO convenes a call and asks whether to pay. The CFO wants to know when you can 'just restore'. Legal has not yet determined materiality. The company is in scope of GDPR and, through its EU distribution subsidiary, of NIS2.
1. What are the first 24 hours of decisions, in what order, and who owns each?
Read the worked answer
Order matters because the reporting clocks start at different moments.
Hours 0-4 - stabilise and structure:
- Appoint an incident commander who is not me; I stay on strategy and external relationships. Stand up the bridge, engage the IR retainer and outside counsel so the investigation sits under privilege where available. Owner: CEO/GC.
- Contain by isolating affected segments rather than powering everything off; preserve volatile evidence; reset privileged credentials and revoke sessions and tokens. Assume the identity plane is compromised until proven otherwise. Owner: CISO with IR lead.
- Activate the BCP: manual fulfilment, defined decision rights for plant restart, customer communication hold. Owner: COO.
- Notify the cyber insurer per the policy clause. Owner: Risk/Finance.
Hours 4-24 - scope and restore capability:
- Forensics on initial access, persistence and whether backups are reachable from the compromised domain. Test-restore a sample from the immutable tier and verify integrity before anyone promises recovery. Owner: IR lead.
- Decide on law enforcement contact (FBI/CISA and EU authorities); Legal owns, I advise on investigative benefit. Owner: GC.
- Begin the materiality assessment with CEO, CFO and Legal. The SEC clock runs four business days from the determination, not from detection, so the determination itself is a managed decision. Owner: CEO with GC.
- GDPR: 72 hours to the lead supervisory authority from awareness if the exfiltration is a personal-data breach. NIS2 via the subsidiary: 24-hour early warning, 72-hour notification, later final report. These run in parallel, not in sequence. Owner: GC/DPO with my factual input.
The trap to avoid: letting the payment debate hold up containment, notifications or recovery. They are independent workstreams.
2. The CEO wants to pay. What is your advice and the reasoning, including what you would need to know?
Read the worked answer
Advice: the decision is the CEO's, but it must be made against explicit criteria rather than a countdown timer.
What I would establish:
- Technical recovery confidence. Do we have a path that does not depend on the attacker - immutable backups for roughly 60% and rebuild capability for the rest? If tier-1 can be rebuilt in days, payment buys convenience, not survival.
- The 40% gap. That is the real argument for negotiating, and also the argument for rebuilding rather than trusting a decryptor. Decryptors are frequently buggy or partial, and decryption speed is not guaranteed.
- Legal exposure. Sanctions screening on the actor and any intermediary. A payment to a sanctioned entity is a legal problem that does not disappear because the business was desperate; counsel owns that assessment.
- Data harm. 800GB including occupational-health records changes the calculus. Paying does not un-exfiltrate anything, and deletion promises are unverifiable.
- Insurer and law enforcement position. Insurers often require notification and may cover negotiation costs; some policies constrain payment.
My recommendation in this fact pattern: do not pay on the 72-hour clock. Put effort into proving restore capability for the 60%, rebuild the rest, and keep a channel open through counsel for intelligence and the exfiltrated-data question while the business runs manually. If the CEO decides to pay, record the decision with the criteria applied, the legal sign-off and the sanctions check.
What I avoid: framing this as a moral question. It is a decision under uncertainty with legal, technical and reputational inputs, and it needs a written record.
3. The CFO asks when you can 'just restore'. How do you answer, and what does the question reveal about your recovery architecture?
Read the worked answer
Answer to the CFO: tier-1 finance and HR can be restored from the immutable tier, but restore is not a switch. Realistically: hours to validate the backup chain, a day to rebuild identity, DNS and PKI dependencies in the correct order, then business validation before the data is trusted. Days for tier-1, weeks for the long tail. The binding constraint is the 40% with no clean backup - that is rebuild-from-scratch work with no source data.
What the question reveals:
- Backups were in the blast radius. A backup architecture sharing a domain with production is not a backup architecture. Immutable, isolated, offline tiering with separate credentials - not 'we have backups' on a slide.
- Restore had never been timed. RTO existed on paper. A real restore exercise against the immutable tier would have exposed the 40% gap and forced it into the budget.
- Dependency ordering was undocumented. Identity, then DNS/PKI, then data, then applications. Without that map, teams restore in parallel and create conflicts under pressure.
- Clean-room capability was missing. Restoring onto compromised infrastructure reintroduces the attacker.
Post-incident programme: isolate and tier backups with separate credentials; test restores quarterly with measured times; document dependency maps per tier-1 service; keep an offline copy of the recovery runbook; and rehearse the notification and materiality decisions as an executive exercise before they are real.