Ransomware Attack Response: Crisis Negotiators Reveal First-Hour Steps to Regain Control
Crisis negotiators Michael Sjøberg and Peter Skovbo outline how firms should respond to a ransomware attack, avoid costly early errors, and regain control.
A ransomware attack can paralyze operations within hours, forcing executives to make high-stakes decisions under intense pressure. Michael Sjøberg, a former Danish military negotiator with experience in hostage crises, and Peter Skovbo, head of Delta Crisis in Switzerland, say the first actions taken by leadership determine whether an organization contains damage or compounds it. Their guidance focuses on rapid containment, disciplined communication, and preserving options for recovery without surrendering control to attackers.
Immediate containment: isolate systems and preserve evidence
When a ransomware attack is discovered, quickly isolating affected systems is essential to limit lateral spread. Disconnecting machines from networks and disabling remote access tools buys time, but must be balanced with preserving forensic evidence for later investigation.
Sjøberg emphasizes that hasty reboots or blanket deletions can destroy logs investigators need to trace the intrusion. Skovbo adds that a coordinated technical playbook, practiced in advance, reduces confusion in those first critical hours.
Crisis leadership: centralize decisions and manage stakeholders
Leadership must appoint a single incident commander to coordinate technical, legal, communications, and executive responses. Fragmented decision-making increases the risk of contradictory actions that attackers can exploit.
Both negotiators stress the value of clear role definitions and an immediate internal briefing to align priorities. This centralized command also ensures that external advisors and law enforcement receive consistent instructions.
Communications: control the narrative without revealing tactics
Public and internal communications should be factual, concise, and controlled; premature or speculative statements can worsen reputational harm. Sjøberg warns that open discussion of technical defenses or negotiation posture can be leveraged by attackers or spark regulatory scrutiny.
Skovbo recommends pre-drafted holding statements and a single spokesperson to minimize mixed messages. Communication must protect victims and customers while demonstrating that the company is acting responsibly.
Negotiation posture: treat attackers as negotiable threats, not partners
Crisis negotiators advise firms to adopt a disciplined negotiation posture if communication with attackers becomes necessary. Framing interactions as information-gathering rather than concessions preserves leverage and reduces the chance of impulsive payment decisions.
Sjøberg draws on hostage negotiation principles: keeping lines of communication open can buy time and reveal attacker motives or capabilities. Skovbo cautions that paying a ransom rarely guarantees full recovery and may invite further demands.
Legal and regulatory steps: notify authorities and document actions
Regulatory obligations, data breach notification timelines, and potential cross-border implications must be rapidly assessed. Early engagement with legal counsel ensures compliance with reporting laws and helps manage exposure to fines or litigation.
Both experts recommend contacting law enforcement promptly to access investigative resources and to avoid later claims of concealment. Documentation of every decision and communication during the incident is essential for audits and recovery planning.
Common costly mistakes in the first hours
The most expensive errors include uncoordinated technical responses, premature payment decisions, and inconsistent public statements. Skovbo notes that panic-driven actions such as unplugging entire data centers without a plan can prolong downtime and increase recovery costs.
Sjøberg highlights the human factor: fear and incomplete information drive many bad choices. Investing in simulated drills and clear escalation pathways reduces the likelihood of such mistakes.
Recovery roadmap: short-term stabilisation and long-term resilience
Restoring operations typically requires a staged approach: containment, forensic analysis, remediation of vulnerabilities, and phased system recovery. Prioritizing critical business functions for restoration limits economic impact while teams work on full recovery.
Long-term resilience includes updated backups, segmented networks, and contractual clarity with third-party vendors. Both negotiators urge companies to treat ransomware preparedness as a continuous program rather than a one-off IT project.
Ransomware attacks test both technical defenses and organizational governance, and the first hours are decisive. By centralizing command, isolating affected systems while preserving evidence, communicating carefully, following legal obligations, and resisting hasty payments, firms can improve their chances of regaining control and reducing lasting damage.
