Ransomware attack: what to do in the first 72 hours to limit losses and preserve evidence

Illustration: servers locked by a ransomware attack, a 72-hour stopwatch and encrypted files

After a ransomware attack, the first step is to isolate the affected systems from the network without shutting them down, reinstalling or “cleaning” them. Then you preserve evidence, inform management and assess your notification duties (DNSC, the data protection authority), and decide on a criminal complaint based on technical analysis, not under the attacker’s deadline.

Key points

  • Ransomware in Romania grew by 153% in 2025 compared with 2024, according to the DNSC annual report, with 256 victims among public institutions, companies and individuals.
  • The first hours are for isolation and evidence preservation, not reinstallation. A formatted system can no longer tell you what happened.
  • Romania’s National Cyber Security Directorate (DNSC) firmly advises victims not to contact or negotiate with attackers.
  • Illegal access, data alteration and system disruption (articles 360-366 of the Romanian Criminal Code) fall under the competence of DIICOT, the specialised prosecution directorate, whether or not the perpetrators form an organised group.
  • Entities covered by NIS2 face strict deadlines: early warning within 24 hours, notification within 72 hours, final report within one month.

Why do the first 72 hours matter so much?

A ransomware attack does not start when the ransom note appears. Attackers usually enter the network days or weeks earlier, obtain privileged accounts, copy data and only then encrypt files. The message on screen is the last stage, not the first.

Three things are decided in the first 72 hours: how far the damage spreads, whether traces of the intrusion survive, and whether the organisation meets its legal deadlines. A rushed decision such as rebuilding servers “to get back to business” can erase exactly the information needed to close the breach and support a criminal complaint.

The attack on Apele Române, Romania’s national water authority, shows how large such an incident can become. DNSC was notified on 20 December 2025, and about 1,000 IT systems were compromised across the national administration and 10 of its 11 river basin branches: GIS servers, databases, workstations, e-mail, web and DNS servers. The attackers did not need exotic malware. They abused BitLocker, a legitimate Windows encryption feature. Operational technology was not affected, and the authority filed a criminal complaint, with a case opened at DIICOT.

The first hours: what to do and what not to do

Do this immediately

  1. Isolate affected systems from the network. Unplug the cable or disable the connection, but keep the machine powered on if possible. Memory holds processes, connections and sometimes encryption keys that disappear at shutdown.
  2. Stop the spread. Block suspicious accounts, reset administrator passwords from a clean device and suspend remote access (VPN, RDP) until things are clear.
  3. Keep everything the attacker left behind. The ransom note, instruction files, contact addresses, suspicious e-mails, system, firewall and VPN logs.
  4. Inform management and appoint one coordinator who liaises with the technical team, lawyers and authorities.
  5. Write down the timeline. When the incident was noticed, who did what, which systems were disconnected. You will reuse it in notifications and in the case file.

Do not do this

  • Do not reinstall, format or run “cleaning” tools on affected systems before evidence is preserved.
  • Do not delete or answer the attacker’s messages.
  • Do not restore from backups until you know they are clean. Attackers deliberately target backups.
  • Do not share technical details publicly before you understand the incident.

Should we pay the ransom?

DNSC’s position is firm: victims should not contact or negotiate with the attackers. The reasons are practical. Paying does not guarantee a working decryption key, does not stop stolen data from being published or sold, and funds the next attack. IBM’s Cost of a Data Breach Report 2025 shows that 63% of organisations refused to pay, and extortion incidents disclosed by attackers cost an average of USD 5.08 million.

The real answer comes from other questions: do clean backups exist, how long will restoration take, what data was copied? Technical analysis answers them. Without it, any decision is a guess.

Evidence preservation: the difference between “we were attacked” and a criminal case

A complaint that only says “we were attacked” rarely moves forward. A complaint supported by documented technical evidence, with a timeline, entry vector, compromised accounts and indicators of compromise, gives the prosecutor a concrete starting point.

Preservation means:

  • full copies of the disks and memory of relevant systems, taken before any intervention;
  • cryptographic hashes calculated at collection, proving later that the data was not altered;
  • logs from systems, network devices and cloud services, exported before they are overwritten (many services keep logs for only a few days);
  • an operations register: who collected what, when and with which tool.

The Romanian Code of Criminal Procedure provides for measures such as the preservation of computer data (art. 154) and the search of computer systems (art. 168), ordered by the authorities. The better a company preserved the traces from day one, the more these measures have to build on.

Which notification duties apply?

Duty Who Deadline Legal basis
Early warning of a significant incident Essential and important entities (NIS2) 24 hours GEO 155/2024
Incident notification Essential and important entities 72 hours GEO 155/2024
Final report Essential and important entities one month GEO 155/2024
Personal data breach notification Any controller, where applicable 72 hours after becoming aware GDPR art. 33
Criminal complaint The victim (management decides) no fixed deadline, as soon as possible Criminal Code, Code of Criminal Procedure

Organisations outside NIS2 can still report the incident to DNSC and ask for support. The NIS2 deadlines are explained in our article on incident notification within 24 and 72 hours.

The criminal complaint: where and with what?

The typical acts in a ransomware attack fall under the Criminal Code chapter on the security of computer systems: illegal access to a computer system (art. 360, up to 7 years for systems with restricted access), altering data integrity (art. 362, 1 to 5 years) and disrupting system operation (art. 363, 2 to 7 years). Under Law 508/2004, these offences fall under DIICOT’s competence regardless of whether an organised criminal group was involved.

A complaint is more useful when it includes:

  • the incident timeline;
  • a description of affected systems and impact;
  • the ransom note and any attacker communication;
  • the preliminary technical report and indicators of compromise;
  • confirmation that evidence has been preserved and can be handed over.

The decision to refer the case to the authorities belongs to the company. Independent technical analysis gives that decision a solid basis.

Days 2 and 3: from isolation to controlled recovery

Once evidence is preserved, technical analysis answers three questions: how the attackers got in, what they did inside the network and which data they touched. The answers shape recovery:

  1. Close the entry vector. A VPN without multi-factor authentication, an exposed server, an account compromised through phishing. If the vector stays open, restoration simply prepares the next attack.
  2. Verify backups in an isolated environment before restoring.
  3. Restore by priority, starting with services critical to operations and customers.
  4. Monitor using indicators of compromise to detect a returning attacker.
  5. Communicate in a controlled way with customers, partners and staff, coordinated with legal counsel.

How ProDefence can help

ProDefence works on ransomware incidents with a simple principle: our role is technical, to establish what happened and document the evidence. We work in five stages: intake, preservation, analysis, documentation, remediation.

You receive:

  • a technical report reconstructing the incident: intrusion vector, attacker actions, affected systems and data;
  • documented evidence in a form usable in criminal proceedings;
  • indicators of compromise to check the rest of your infrastructure;
  • a prioritised remediation plan;
  • technical support during the proceedings, at your request or the authorities’.

See Cybercrime investigation, and, if the incident began with a suspicious file or e-mail, malware and fraud analysis.

For lawyers taking over the case, ProCIS turns technical and documentary material into a verifiable chronology (ProCIS is currently contracted in Romanian). For NIS2 entities that need someone to handle notifications and measures on an ongoing basis, there is the outsourced NIS2 officer service.

Frequently asked questions

What should I do immediately after discovering a ransomware attack?

Isolate affected systems from the network without shutting them down, if possible. Do not reinstall, format or run cleaning tools. Keep the ransom note, logs and suspicious e-mails, inform management and record the timeline. Then check your notification duties towards DNSC and the data protection authority and request a technical analysis.

Is it legal to pay the ransom?

The legal question should be discussed with a lawyer. In practical terms, DNSC firmly advises victims not to contact or negotiate with attackers. Paying does not guarantee decryption, does not prevent stolen data from being published and funds further attacks. Any decision should follow an assessment of backups and affected data.

Can encrypted data be recovered?

It depends on the ransomware variant, on the existence of unaffected backups and on how the encryption was carried out. Sometimes a solution exists, most often it does not. No serious provider guarantees recovery before analysis. The analysis establishes what can be restored and from which sources.

Where do I file a criminal complaint for ransomware in Romania?

The typical offences (illegal access, data alteration, system disruption, articles 360-366 of the Criminal Code) fall under DIICOT’s competence under Law 508/2004, whether or not the perpetrators form an organised group. The complaint is stronger with a timeline, a technical report and confirmation that evidence was preserved.

Do I need to notify the data protection authority?

If the attack affected personal data and there is a risk to the people concerned, the controller notifies the authority within 72 hours of becoming aware, under article 33 GDPR. Modern ransomware often copies data before encrypting it, so the assessment is needed in every case.

My company is not covered by NIS2. Can I still ask DNSC for help?

Yes. Any organisation can report an incident to DNSC and request support. The 24-hour, 72-hour and one-month deadlines are mandatory only for essential and important entities, but fast reporting helps everyone.

Sources

Alexandru Angheluș, ProDefence. Cybersecurity specialist working on cyber incident investigation, malware analysis and NIS2 compliance.

Incident notification under Romania’s NIS2 law: 24 hours, 72 hours, one m...Illustration: NIS2 incident notification deadlines, a stopwatch and a report sent to the authority
Skip to content