The First 60 Minutes: What Happens When Your Network Is Breached

The Clock Starts Now

A ransomware attack doesn’t announce itself with sirens. It starts with something small-a frozen screen, an error message, a file that won’t open. By the time most organizations realize what’s happening, they’ve already lost precious time.

The first 60 minutes after a breach begins are the most critical. What happens in that window often determines whether an incident becomes a manageable problem or a catastrophic failure.

Here’s what actually happens-minute by minute-when ransomware hits an organization that isn’t prepared.

Take Our 2-Minute Security Assessment

Minute 0-5: The First Signs

• An employee notices something strange. Maybe a file won’t open. Maybe their screen freezes momentarily. Maybe they get an unusual error message.
• Most people do what seems reasonable: they restart their computer. Or they ignore it and move on to something else. After all, computers glitch sometimes.
• Meanwhile, the ransomware is already spreading through shared drives, looking for backup systems to encrypt, and establishing persistence across the network.

Minute 5-15: The Confusion Phase

• More employees start reporting problems. Someone mentions it to IT. But it’s not clear yet whether this is a cyberattack, a server issue, or just a bad software update.
• IT staff begin troubleshooting. They check the servers. They look at recent changes. They’re not yet in “incident response” mode-they’re in “technical support” mode.
• The ransomware continues spreading. Every minute of confusion is another minute of encryption.

Minute 15-30: Recognition

• Someone finally sees the ransom note. Or the encryption becomes so widespread that there’s no denying what’s happening.
• Now the panic sets in.
• Who do we call? What do we shut down? Where are the backups? Does anyone have the incident response plan? Who has authority to make decisions?
• In organizations without a plan, these questions create paralysis. People look at each other, waiting for someone to take charge. Precious minutes tick by.

Minute 30-45: The Scramble

• Someone starts making decisions-whether or not they’re the right person to do so. Systems get disconnected, sometimes in the wrong order. People start calling vendors, lawyers, insurance companies.
• But without a plan, every action raises more questions. Should we pay the ransom? Who decides that? Do we have cyber insurance? What does our policy require us to do? Should we call law enforcement? Will that make things worse?
• The ransomware has likely finished its initial encryption by now. The damage is done. Everything from this point is containment and recovery.

Minute 45-60: The Aftermath Begins

• Leadership gets involved-often people who have no technical background and no context for what’s happening. They need briefings. They need options. They need answers that don’t exist yet.
• Meanwhile, employees are sitting idle. Customers are calling. Partners are asking questions. The press may have already gotten wind of something.
• The next several days-or weeks, or months-will be consumed by recovery. But the trajectory of that recovery was largely determined in the first hour.

What Prepared Organizations Do Differently

Organizations that survive ransomware attacks well don’t do anything magical. They just don’t waste the first hour on confusion and scrambling.

1. They have an incident response plan. Not a dusty binder on a shelf, but a real plan that people have actually practiced. When something happens, everyone knows their role.
2. They have clear decision authority. Someone is empowered to make the call to shut systems down. They don’t need to convene a committee or get executive approval.
3. They have communication templates ready. Internal announcements, customer notifications, press statements-all drafted in advance, waiting to be customized.
4. They have relationships established. Their cyber insurance carrier, their legal counsel, their incident response vendor-all identified and contacted before an emergency.
5. They have tested their backups. Not just “we have backups” but “we have verified that we can actually restore from these backups in a reasonable timeframe.”

The 60-Minute Test

Here’s a simple exercise: Imagine ransomware hits your organization right now. Ask yourself:

• Who would notice first, and would they know who to tell?
• Who has authority to shut down systems without asking permission?
• Where is your incident response plan, and when was it last updated?
• Could you restore critical systems from backup within 24 hours?
• Do you have phone numbers for your insurance carrier and legal counsel somewhere that doesn’t require your computer to access?

If you can’t answer these questions confidently, you know what your next project should be.   Contact us today.

Not Sure Where You Stand? Take Our 2-Minute Security Assessment

centrexIT has helped San Diego organizations prepare for-and recover from-cyber incidents since 2002. If you’re not sure how your organization would handle the first 60 minutes of an attack, let’s find out together.