The First 24 Hours: What Happens When Ransomware Lands

Encryption is the last step of the intrusion. Mandiant's M-Trends 2026 puts the global median dwell time at 14 days, so hour zero for you is usually week two for them.

Assume the data left before the files are locked. CISA's Akira advisory records cases where exfiltration was complete two hours after the attacker got in.

Restore something from a backup before anyone gives the board a recovery time. Ransomware crews now hunt backup infrastructure on purpose.

Most first-day failures are decision failures. The technical steps are written down somewhere. The authority to take them usually is not.

The first report rarely comes from a detection rule. It comes from a shift supervisor who can't open the production schedule, or from a finance clerk who found a text file on the shared drive with payment instructions in it.

By the time that call reaches you, the part of the attack you can still influence has already started. What follows is the shape of a first day, hour by hour, as I have watched it run in ransomware engagements across food production, business services and retail. The hour markers are approximate. The order is not.

Hour 0: The clock started long before you noticed

The most useful thing to establish in the first ten minutes is when this began, and the answer is almost never today.

Mandiant's M-Trends 2026, published in March 2026 and built on over 500,000 hours of frontline investigations, reports global median dwell time rose to 14 days from 11.

A second finding in that report changes how you scope the day. In 2022, the median gap between an initial access event and the hand-off to a second threat group was more than eight hours. By 2025 it had collapsed to 22 seconds.

The practical consequence: the crew encrypting your files is often not the crew that broke in. You are reconstructing two sets of activity with different tooling and different goals, and the quiet one came first.

Hours 0 to 1: Confirm it before you say the word