Ransomware at a Regional Logistics Operator: First Six Hours and Recovery Sequencing
At 02:10 on a Saturday, Atlas Freight's SOC detects ransomware on 60 of 1,100 endpoints across four of 14 distribution centers. The EDR console shows a domain administrator account was used to push the payload. The company has a $5M cyber insurance policy with a $500K retention. Backups: 60% are immutable cloud copies; 40% are on a NAS joined to the domain. The MSSP contract promises a one-hour response but there is no joint playbook and the on-call escalation list is 18 months old. Customer SLAs require status updates within 24 hours; state law requires breach notification within 72 hours if PII is involved. The CEO asks whether to pay the ransom, which is demanded in cryptocurrency, and wants operations restored by Monday. No tabletop exercise has been run.
1. What should the incident commander do in the first six hours? Prioritize containment, evidence, and communications.
Read the worked answer
First six hours
0-1 hour: activate and contain. Declare a major incident and activate the crisis team. Isolate the four affected distribution centers at the network segment level, not just the 60 endpoints. Disable the compromised domain administrator account and reset privileged credentials. Block known command-and-control indicators. Do not power off servers indiscriminately; preserve memory and logs where feasible.
1-2 hours: scope and protect. Determine whether the NAS backups are encrypted or reachable. Disconnect the NAS from the domain and preserve immutable cloud copies. Check identity logs for lateral movement and persistence. Identify which distribution centers and customer-facing systems are affected. Engage the insurer's breach response panel and outside counsel to direct the investigation under privilege.
2-4 hours: stabilize and communicate. Stand up a bridge with operations, legal, communications, and the MSSP. Assign a scribe and a decision log. Send an initial internal alert with a single source of truth. Prepare a holding statement for customers, but do not speculate about data exposure. Start the 72-hour notification assessment: what PII is involved, which states, and what evidence exists.
4-6 hours: recovery feasibility. Validate the integrity of immutable backups and estimate restoration time. Determine whether clean rebuild is possible without rejoining the compromised domain. Identify manual workarounds for the highest-priority distribution centers. Set the next update cadence and escalate to the CEO with facts, unknowns, and decisions needed.
What not to do
Do not pay the ransom in the first six hours. Do not restore onto the compromised domain. Do not let the MSSP operate without a joint incident action plan. Do not miss the customer update window because the team is focused only on forensics.
2. How should Atlas handle the ransom decision and the 24-hour and 72-hour communication obligations?
Read the worked answer
Ransom decision
Treat payment as a business and legal decision, not a technical one. Consider: whether backups are sufficient and tested; the expected restoration time without a decryptor; whether the attacker has exfiltrated data and is threatening disclosure; the reliability of any decryptor; sanctions exposure and insurer requirements; and the effect on customers and regulators. Payment does not guarantee recovery and may create legal and reputational risk.
The CEO should receive a decision brief with options: restore from backups, rebuild manually, pay, or a combination. If payment is considered, involve counsel, the insurer, and a sanctions screening process before any transaction. Document the rationale either way. Set a decision deadline based on operational impact, not the attacker's deadline.
24-hour customer communication
Customer SLAs require status updates within 24 hours. The update should confirm the incident, state which services are affected, give the next update time, and avoid unverified attribution or data-exposure claims. Assign a single customer communication owner and a script. Do not let account managers improvise.
72-hour regulatory assessment
State law requires notification within 72 hours if PII is involved. The team must determine whether PII was accessed or exfiltrated, which state laws apply, and whether the threshold is met. If the facts are incomplete at 72 hours, consult counsel on whether a preliminary notification is required. Preserve evidence for the notification decision. The same facts should inform insurer notice and any contractual notification obligations.
3. Recommend a recovery sequence for the 14 distribution centers and justify the trade-offs. What must be true before restoring from the NAS?
Read the worked answer
Recovery sequence
Recover in waves based on customer criticality, not evenly across all sites. Wave 1: the distribution centers serving the highest-volume customers and any site with safety or cold-chain dependencies. Wave 2: remaining distribution centers. Wave 3: corporate IT and non-critical analytics. Within each wave, restore identity services first, then the warehouse management system, then integrations to customer systems.
Rebuild from trusted images and immutable backups. Do not rejoin restored systems to the compromised domain until domain controllers are rebuilt and privileged credentials are rotated. Enforce MFA for all administrative access and monitor for re-infection. Validate restoration with business acceptance tests, not just service start.
NAS trade-off
The NAS is domain-joined, so it is not trustworthy after a domain administrator compromise. It may be used only after forensic review confirms it was not accessed, or after it is rebuilt from a known-good state. Until then, rely on immutable cloud copies and manual workarounds. Restoring from the NAS before validation risks reinfection and a second outage.
Justification
Restoring everything at once overwhelms the team and increases the chance of error. A wave approach restores revenue and customer trust sooner while keeping the compromised domain isolated. It also gives the incident team time to validate backups and rebuild identity. The CEO's Monday goal may be achievable for one or two sites, but not all 14; the incident commander should state that explicitly and give a realistic schedule rather than promise full restoration.