Module 8 · 8.3

English

Nederlands English Deutsch

After a hack or ransomware attack: recovering without getting reinfected

Module 8: When things go wrong · Reading time: 11 minutes

Learning objective: After this lesson, you can work through the recovery phase after a hack or ransomware attack: containing it, finding out how it happened, restoring cleanly, reporting it, communicating, and learning from it.

Key concepts: containment, isolation, initial access, persistence, forensic investigation, clean reinstall, recovery order, reporting a crime, No More Ransom, ransom, cyber insurance, evaluation

The biggest mistake: restoring everything too quickly

A web developer gets a report on Tuesday: a client's WordPress site is redirecting visitors to a fake shop. He restores last week's backup, the site works again, done. On Thursday it happens again. The attacker had got in through an outdated plugin and had left behind an extra admin account and a hidden file. Last week's backup already contained these. Restoring without knowing how someone got in also restores the open door.

The same thing happens with ransomware on an office network. Criminals are often inside for days or weeks before they encrypt anything. During that time, they create extra accounts, install remote access software, and look for the backups. If you only restore the encrypted files, you keep the attacker inside.

Recovery therefore happens in five steps, in this order.

Step 1: contain

Containing means making sure things don't get worse. The first few minutes are on your incident card (lesson 8.1).

Isolate affected devices: unplug the network cable, turn off wifi and mobile data, or switch to flight mode. The NCSC advises disconnecting affected systems rather than switching them off; sleep mode is fine. This preserves traces in working memory and stops the spread.
Disconnect external drives and backup media and don't connect them to a device that may be infected.
If you can't isolate a system, disconnect it from the network drive instead. If the whole network has been affected, cut it off from the internet (for example by closing the internet connection or the firewall).
Change passwords from a clean device, starting with the most important ones: admin accounts, email, the password manager, the bank. Log out of all sessions everywhere. Don't do this from a computer that may contain an infostealer or keylogger (lesson 1.4), because then you'd be reading the new password straight out to the attacker.
Keep evidence: a photo of the ransom message, the emails, payment requests, crypto addresses, timestamps. Don't throw anything away.

For a hacked website, containing it means: temporarily taking the site offline or putting it in maintenance mode, changing all passwords (admin, FTP, database, hosting), and involving your hosting provider.

Step 2: find out what happened

You want to know three things:

How did they get in? The initial access: a phishing email, a stolen password without 2FA, an outdated VPN server or plugin, an open connection for remote management.
What did they leave behind? The persistence: extra accounts, scheduled tasks, remote management software, forwarding rules in mailboxes, extra files on the web server.
What did they take? With modern ransomware, criminals often copy data first and then threaten to publish it (double extortion, lesson 1.3). In that case you also have a data breach (lesson 8.2).

For a small business, this is rarely something you can do yourself. Bring in your IT supplier, or a specialist incident response company. Many cyber insurance policies have a dedicated number for such a team. If you use an external company, ask what experience it has with your type of incident and agree in advance what the investigation will cover.

For a website, the access log and error log of the web server help, along with a malware scan of the files and a comparison with a clean copy of the CMS and plugins.

Step 3: restore cleanly

Only start recovery once you know how the attacker got in and that route is closed.

What	How
Infected computers	Don't "clean up", reinstall completely from a trusted source. After that, install all updates first, then restore data.
Data	Restore from a backup you're reasonably sure predates the breach. Check the files before they go back on the network.
Website	Clean install of the CMS and plugins in the latest version, restore only your own content (text, images, database), and check that content for strange scripts or users.
Accounts	Remove unknown accounts, reset all passwords, turn on 2FA, revoke sessions and app passwords.

Recover in the order set out in your plan (lessons 8.1 and 6.3): start with what the business needs to keep running. Keep the restored part separate from what hasn't been checked yet.

This is where you find out whether your backup holds up. A backup that was connected to the network is often encrypted or wiped along with everything else. An offline or immutable backup (lesson 6.2) and a tested restore procedure (lesson 6.3) make the difference between days and weeks of downtime.

Step 4: reporting and ransom

Report it to the police. Businesses can make an appointment via the police non-emergency number 0900-8844 (emergency 112). Bring the evidence (ransom message, emails, payment details). A police report is needed for investigation, helps the police spot connections, and insurers often ask for it.

No More Ransom. At https://www.nomoreransom.org (an initiative involving, among others, Europol and the Dutch police) you can have an encrypted file or the ransom message identified. A free decryptor exists for some ransomware families. Not for most new variants, but it costs little time to check.

Reporting obligations. Work out which reports are needed: a data breach to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) within 72 hours (lesson 8.2), a significant incident via MijnNCSC (registration portal of the NCSC) if you fall under the Cyberbeveiligingswet (Cbw, the Dutch Cybersecurity Act implementing NIS2) (lesson 9.1), and whatever you've agreed with clients or customers.

Ransom. The NCSC advises against paying a ransom, and the Dutch police say "preferably don't pay". The reasons:

You have no guarantee that you'll get a working key, or that the data won't be published anyway.
Data you get back may be damaged or altered.
Anyone who pays becomes known as someone who pays. Victims are sometimes extorted again or attacked again later.
You're funding the next attack.

If you're still considering paying, or you have paid, always report it to the police: the payment details can help the investigation. This decision belongs to the decision maker named in your incident plan, not to whoever sees the message first.

Cyber insurance. Cyber insurance can cover costs for investigation, recovery and business losses, and often gives access to an incident response team. Read the terms: many policies require baseline measures such as 2FA and backups, and require you to report quickly. In April 2025, based on research into more than 500 ransomware incidents affecting SMEs, the NCSC wrote that after breaking in, attackers search for files with names like "insurance" or "policy" to strengthen their negotiating position. So check how easily an intruder could find your policy, and preferably don't keep it on a shared drive. Insurance doesn't replace security measures: it pays for the damage, but doesn't prevent it.

Step 5: communicate and learn

Have the communicator named in your plan tell one clear story to staff, customers and suppliers: what happened, what it means for them, what they need to do (for example: watch out for emails that appear to come from us), and when they'll hear from you again. Being honest and timely works better than staying quiet until it leaks out.

Schedule an evaluation within a few weeks: what went well, what went wrong, what will you change? Almost always the same points come up: 2FA was missing somewhere, a system hadn't been updated, the backup hadn't been tested, or nobody knew who was allowed to decide. Add these points to the plan from lesson 9.3, with an owner and a date.

In practice: what it looks like

For a hacked website on a hosting package, you'll often work with your hosting provider's tools. At WebOké, for example, these include a malware scan (Imunify360), the log files in DirectAdmin, restoring a backup from WebOké Backups, and a step-by-step guide in the DirectAdmin manual. Other hosting providers have similar tools; ask your provider what's available and how far back the backups go, before you need it.

Summary

Recovery happens in five steps: contain, investigate, restore cleanly, report, communicate and learn.
Isolate, don't switch off, and only change passwords from a clean device.
Don't restore anything until you know how the attacker got in; otherwise you also restore the open door.
Reinstall infected devices and recover from a backup that predates the breach.
Report it to the police, check No More Ransom, and preferably don't pay a ransom.

Quiz

Exercise

Exercise A8.3: Put the recovery in the right order. You're given a scenario and ten separate steps (for example "restore backup", "unplug network cable", "find out how the attacker got in", "report it to the police"). Put them in the correct order. The program checks whether the fixed ordering rules are followed (for example: isolate before restoring, find the cause before restoring, reinstall before restoring data) and explains why for each mistake.

Cookies at WebOké

Cookie settings

Necessary

Marketing