What Happens During a Ransomware Incident?

Ransomware is often described as a single event. It is closer to a phased operation that unfolds over days or weeks, with the encryption stage arriving late in the sequence. Understanding the phases helps leaders prepare for the decisions they will face at each one.

1. Initial access

Attackers gain a foothold — usually through phishing, a stolen credential replayed against a service without MFA, or an unpatched internet-facing system. Nothing visible happens to users at this point.

2. Escalation and reconnaissance

The attacker elevates privileges, disables or blinds security tools, and maps the environment: file shares, backups, domain controllers, hypervisors. This can take days to weeks. Well-tuned monitoring often has its best chance of detection here.

3. Data exfiltration

Modern ransomware groups steal data before encrypting it. That way, even a business with clean backups can be extorted with the threat of publication. Exfiltration is a distinct legal and regulatory event with its own notification obligations.

4. Encryption

The visible event: files across the environment are encrypted, backups are targeted, and a ransom note appears. If the earlier phases were successful, this stage can complete in hours.

5. Response and recovery

• Contain — isolate affected systems and revoke suspect credentials.
• Engage — legal counsel, cyber-insurance, and forensic responders, in that order.
• Investigate — determine scope, timeline, and what data was accessed.
• Restore — from known-good backups, in an order that prioritizes revenue-critical systems.
• Notify — clients, regulators, and where required, individuals whose data was affected.

How to prepare

Tested backups, an incident-response contact list you can reach without email, and a written decision framework for engaging insurance and counsel. Preparation is not glamorous. It is the difference between a bad week and an existential event.