Ransomware Recovery: What Happens After an Attack

The True Cost of Ransomware Recovery

The ransom payment — if made — is often not the largest cost of a ransomware incident. The average cost of a ransomware recovery for a small to mid-sized business in 2025 is $140,000, and that figure includes downtime, recovery costs, and lost productivity but often underestimates legal costs, regulatory penalties, and reputational damage. Recovery from a significant ransomware incident typically takes two to four weeks for basic operations and months for full restoration.

Immediate Response (Hours 1–48)

The first hours after discovering a ransomware attack are critical and chaotic. The immediate priorities are:

• Isolate affected systems from the network to stop lateral spread
• Identify the scope — how many systems are encrypted, what data may have been exfiltrated
• Engage your incident response team or retainer firm
• Preserve forensic evidence — do not simply wipe and restore without understanding how access was gained
• Contact legal counsel — attorney-client privilege may protect your communications
• Notify cyber insurance carrier immediately — most policies require prompt notification

Regulatory Notifications

Ransomware attacks typically trigger notification obligations. NYDFS requires notification within 72 hours of determining an incident occurred. HIPAA requires notification to HHS and potentially to affected individuals within 60 days of discovery. State breach notification laws vary but many require notification within 30 days. Failure to notify on time compounds regulatory risk significantly.

To Pay or Not to Pay

The ransom payment decision involves law enforcement considerations (FBI advises against payment), OFAC compliance (paying sanctioned groups is illegal), insurance coverage limits, and the practical question of whether paying will actually produce working decryption keys. In practice, many organizations pay when they have no viable alternative and when their insurance covers it — but the FBI reports that roughly 40% of victims who pay do not receive working decryption tools, or receive tools too slow to be practical.

Rebuilding from Scratch

Even organizations with good backups often cannot simply restore from backup and resume operations. Attackers frequently remain in the environment after deploying ransomware, waiting to re-attack once systems are restored. A thorough forensic investigation to understand initial access, persistence mechanisms, and the full scope of compromise must precede restoration. Organizations that skip this step are often hit again within weeks.