Nobody plans to read this at 7:40 on a Tuesday morning with a note on every screen demanding payment. But if ransomware ever lands on your network, the decisions you make in the first hour will matter more than almost anything that comes after. Move well, and a bad day stays a bad day. Move badly — power off the wrong machine, keep working on an infected one, start deleting things — and you can turn a recoverable incident into a catastrophe.
For healthcare and senior-care providers the stakes are higher still, because care can't just stop while you sort it out. Residents still need their medications; patients are still in the waiting room. This is a plain-English playbook for that first hour — what to do, in what order, and what not to do.
Why the First Hour Decides the Outcome
Ransomware doesn't politely encrypt one computer and wait. Once it executes, it tries to move laterally — reaching across shared drives, servers, and any backups it can touch — and it often works fast. The point of a fast, disciplined response isn't heroics; it's to cut off that spread and preserve your options: clean backups to restore from, evidence for investigators and insurers, and a clear record for the HIPAA breach assessment that will follow. Panic erodes all three. A plan protects them.
The First-Hour Playbook
If you remember nothing else, remember the order: isolate, call, contain, preserve, keep care going.
- Isolate — but don't power off. Disconnect affected machines from the network: unplug the network cable, turn off Wi-Fi. This stops the spread. Resist the urge to shut them down — powering off can destroy forensic evidence in memory that investigators and your insurer may need. Pull it off the network; leave it running.
- Call your IT/security team immediately. Activate your incident-response plan and its single point of contact. This is not the moment to troubleshoot alone — the clock is running and the right people need to be moving.
- Contain the spread. Disconnect shared network drives, isolate affected network segments, and — critically — get your backups off the network so they can't be encrypted too. Attackers go after backups on purpose; protecting them is what keeps recovery on the table.
- Preserve evidence — don't wipe or "clean up." Don't delete files, reimage machines, or start restoring blindly. Leave the scene intact for the people who need to understand what happened and prove what was (and wasn't) accessed.
- Switch to downtime procedures for care. This is the healthcare difference. Move to your documented EHR/eMAR downtime process — paper charting, downtime medication records, manual workflows — so residents and patients stay safe while systems are down. Having those forms printed and ready before a crisis is what makes this step possible.
- Do not pay or message the attackers yourself. Any communication — or payment — should go through your incident-response, legal, and cyber-insurance team, not a staff member in the moment. Paying has legal and practical landmines, and it's a decision to make with advisors, not under pressure.
- Notify the people who have to know. Leadership, and your cyber-insurance carrier — many policies require immediate notice and will send in their own response team. This is also when the HIPAA/HITECH breach-assessment clock starts, so getting the right people engaged early protects you later.
Get the affected machines off the network without powering them off, and call your incident-response contact. Those two moves — containment plus the right people — buy you the time and options for everything else.
The Work That Makes the First Hour Easy
Here's the uncomfortable truth: the organizations that get through that first hour calmly are the ones that did the work months earlier. They have tested, offline backups they know will restore. They have a written incident-response plan with named roles, not a vague idea of who to call. Their downtime procedures are printed and practiced, not theoretical. They carry cyber insurance and know its requirements. And they run endpoint detection & response (EDR) that can automatically isolate a compromised machine the moment it misbehaves — sometimes before a human even sees the ransom note.
None of that is exotic, and none of it happens during the attack. It happens now, quietly, as part of a managed security program — so that if the worst day ever comes, you're reading from a playbook instead of writing one in a panic.
Would You Know What to Do?
Plexus builds and runs the backups, incident-response plans, and security monitoring that turn a ransomware attack from a disaster into a manageable event — HIPAA-aligned, for healthcare and senior-care providers across Florida. Start with a free IT & security assessment and we'll show you where you'd stand.
Schedule Free Assessment