Summary: What to do in the first 24 hours after detecting ransomware or an account takeover: a step-by-step plan for isolation, evidence, communication and breach notification.

The decisions made in the first hours of a cyber incident determine how big the loss becomes. Shutting down servers in a panic can destroy evidence; waiting gives the attacker time to spread. That is why the plan for the first 24 hours has to be written before an incident happens.

Hour 0–1: Confirm and assemble the team

  • Confirm the alert is real: EDR alarm, encrypted files, unusual sign-ins.
  • Name an incident lead. One person decides, others execute.
  • Open an incident log: time, who, what they saw, what they did. This record is the basis of every later step.

Hours 1–4: Stop the spread

  • Disconnect affected devices from the network; where possible, pull the cable or isolate via EDR instead of shutting down, so evidence in memory is preserved.
  • Reset passwords of suspected compromised accounts and end active sessions.
  • Temporarily disable VPN and remote access if needed.
  • Disconnect the backup system from the network; attackers target backups first.

Hours 4–8: Determine the scope

Review firewall, server, Microsoft 365 and EDR logs to understand where the attacker got in, which systems they reached and whether data was exfiltrated. Without central logging this step can take days.

Hours 8–12: Manage communication

  • Give management a short, factual status summary.
  • Tell staff what to do and what not to do through a single channel.
  • If you have cyber insurance, notify the insurer; most policies require notice within a set period.
  • Talk to your legal advisor before responding to any ransom demand.

Hours 12–24: Notification and recovery plan

If personal data is affected, breach notification deadlines apply: under Turkey's KVKK, the Personal Data Protection Board must be notified within 72 hours of learning of the breach, and GDPR sets a similar 72-hour window. That time goes quickly; start preparing the notification on day one.

At the same time, set the recovery order: identity infrastructure first (Active Directory / Entra ID), then critical business applications, user devices last. Restore from a backup confirmed to be clean.

Practical tip

Print the emergency contact list (management, IT, legal, insurer, external support). During an attack, email and file servers may be unavailable.

Prepare before the incident

At Bilgi Teknoloji we prepare your incident response plan together with ransomware protection, EDR, central logging and immutable backup.

Is your incident response plan ready?

Let's write the plan together and test it in a tabletop exercise.

Request a call