Act fast… but act right
Local backups are useless; the attacker accessed and deleted them. Offsite backups appear intact. The instinct is understandable: restore immediately. However, in incident response, speed must not replace a structured approach.

The right first step is to mobilize the appropriate resources: contact your cyber insurance provider to activate included services (incident response experts, legal counsel, infrastructure specialists) or, if unavailable, engage a crisis management firm. These professionals can guide both the organization and its MSP to stabilize the situation and avoid rushed decisions.

More than just a technical issue
A cyberattack is not only about getting systems back online. It also involves managing internal (employees) and external (clients, partners) communications, assessing potential data exfiltration, meeting legal and regulatory obligations, and securing the IT environment before any restoration.

Too often, IT providers or organizations attempt to handle incidents internally. This is risky: an incorrect sequence of actions can worsen the technical impact (reinfection, loss of evidence, backup corruption) and increase legal exposure.

The question of paying the ransom highlights the complexity: when (and if) to open communication with the attacker, who should negotiate, how to reduce fraud risks and manage the transaction, and what the legal implications are. These decisions are best made with specialists experienced in handling such cases.

Prevention… and preparedness
Prevention remains essential (segmentation, MFA, immutable backups, restoration testing, etc.). Too often, organizations believe they are secure when they are not; it is therefore critical to work with cybersecurity experts to validate that best practices are in place.

But when an incident occurs, the priority is to respond in a structured way. The fire analogy is fitting: a small fire can be handled with an extinguisher; a spreading fire requires evacuation and calling the fire department. In cybersecurity, the principle is the same: contain quickly, preserve evidence, then rely on the right expertise to restore operations and minimize impact.