Data Recovery After a Cyber Attack: A Step-by-Step Playbook

The first hours after ransomware or a breach are stressful and confusing. Screens show ransom notes, staff cannot open files and everyone wants to know when things will be back to normal. Successful data recovery after a cyber attack depends less on heroics and more on following a clear order of steps, so you restore what matters without letting the attacker back in.

This playbook is written for small and mid-sized organisations without a large security team. It covers what to do immediately, how to judge whether your backups can be trusted, how to restore safely and how to make the next incident far less painful.

Step One: Contain Before You Recover

It is tempting to start restoring files straight away. Resist that urge. If the attacker still has access, or malware is still spreading, restored data can be encrypted or stolen all over again.

• Isolate affected systems by disconnecting them from the network, unplugging cables or disabling Wi-Fi. Avoid powering machines off unless advised, because memory can hold useful evidence.
• Disable compromised accounts and reset passwords for administrators and any accounts showing unusual activity, using a device you know is clean.
• Protect your backups by disconnecting backup servers and storage from the network if they are not already isolated.
• Preserve evidence such as logs, ransom notes and suspicious files. Investigators and insurers may need them.

At this point, contact your cyber insurer if you have one, and consider bringing in a professional incident response firm. Many policies require you to notify them quickly and use approved responders.

Step Two: Understand What Happened

Before restoring, you need a reasonable picture of the attack. Key questions include how the attacker got in, which systems they touched, how long they were present and whether data was copied out as well as encrypted.

The answers shape your recovery. If the entry point was a vulnerable remote access service, restoring a server with that same flaw simply reopens the door. If attackers were inside for weeks, recent backups may contain their tools or backdoors. And if data was stolen, you may have legal duties to notify customers or regulators, regardless of how quickly you restore.

Government resources can help. In the United States, CISA’s StopRansomware hub offers guidance and a ransomware response checklist, and many other countries run similar national cybersecurity centres that accept incident reports.

Step Three: Find and Verify Clean Backups

Your backups are the heart of data recovery after a cyber attack, but only if they are intact and free from malware. Modern ransomware groups often target backups first, deleting or encrypting them to increase pressure to pay.

Questions to Ask About Each Backup

1. Was it stored offline, immutable or in a separate account the attacker could not reach?
2. When was it taken, and was that before the attacker first gained access?
3. Has it been scanned with up-to-date security tools in an isolated environment?
4. Can you actually open and read the restored files, not just see that the backup job reported success?

Restore a sample into an isolated test environment first. Check that applications start, databases are consistent and documents open correctly. This step can feel slow during a crisis, but it prevents the far worse outcome of reinfecting your network.

Comparing Backup Types for Recovery

Backup type	Resistance to ransomware	Recovery speed	Notes
Network share or attached drive	Low	Fast	Often encrypted along with everything else
Offline disk or tape	High	Slow to moderate	Safe if disconnected, but needs manual handling
Immutable cloud backup	High	Moderate	Cannot be altered or deleted during a retention period
Cloud sync service (file sync)	Low to moderate	Fast	Syncs encrypted files too; version history may help

Step Four: Restore in the Right Order

Restoring everything at once overwhelms teams and makes it hard to spot problems. Instead, rebuild in priority order based on what the business needs to function.

1. Core infrastructure: identity systems such as domain controllers, DNS and network devices. If identity is compromised, rebuilding it cleanly may be safer than restoring it.
2. Security tools: endpoint protection, logging and monitoring, so you can watch for any sign of the attacker returning.
3. Critical business applications: the systems that generate revenue or support customers, such as order processing, accounting or patient records.
4. Supporting systems and file shares: everything else, in order of importance.

Where possible, rebuild servers from clean installation media and then restore data onto them, rather than restoring entire system images that might carry hidden malware. Apply all security patches before reconnecting each system to the network.

Step Five: Handle Systems Without Good Backups

Sometimes a server or laptop simply was not backed up. You still have options, though none are guaranteed.

• Check whether a free decryptor exists for the specific ransomware strain. Projects such as No More Ransom collect tools released by security researchers and law enforcement.
• Look for copies elsewhere: email attachments, cloud document history, staff devices or files shared with partners.
• Use professional data recovery services for damaged drives, but choose reputable firms and be wary of any that quietly pay ransoms on your behalf.

Paying a ransom is a serious decision with legal, ethical and practical risks. Payment does not guarantee working decryption, may break sanctions rules in some cases and can mark you as a willing target. Discuss it with legal counsel, your insurer and law enforcement before considering it.

Step Six: Strengthen Defences Before Going Fully Live

Recovery is the moment when you have the most attention and budget for security. Use it. Close the entry point the attacker used, enforce multi-factor authentication on email, remote access and admin accounts, and remove old accounts and unused remote services.

Increase monitoring for at least several weeks after the incident, because attackers sometimes attempt to return. Keep an eye on new administrator accounts, unexpected scheduled tasks and unusual outbound connections.

Communication matters at this stage too. Give staff a short, honest update on what happened, what they should and should not do, and how to report anything suspicious. Remind them that attackers often follow up a breach with convincing phishing emails that reference the incident, sometimes pretending to be IT support or the company’s bank.

Building a Better Recovery Plan for Next Time

The best time to prepare for data recovery after a cyber attack is long before one happens. A simple plan written in plain language, printed and stored offline, can save days of confusion.

• Follow the 3-2-1 approach: three copies of important data, on two different types of media, with one copy offsite and ideally offline or immutable.
• Test restores regularly, including a full rebuild of at least one critical system each year.
• Define recovery time and recovery point objectives for each key system, so everyone knows what “back to normal” means.
• Keep an up-to-date contact list for your IT provider, insurer, legal adviser and incident response firm.
• Run a short tabletop exercise where managers walk through a pretend ransomware scenario.

Frequently Asked Questions

How long does recovery from ransomware usually take?

It varies widely, from a few days to several weeks, depending on how many systems are affected, the quality of backups and how prepared the organisation was.

Should I restore from my most recent backup?

Not automatically. Choose a backup from before the attacker gained access, then scan and test it in isolation before using it in production.

Can antivirus alone clean up after an attack?

Rarely. Attackers often leave backdoors and stolen credentials behind, so a thorough investigation and clean rebuild of key systems is usually needed.

Do I have to report a cyber attack?

Depending on your location and industry, laws may require you to notify regulators or affected people, especially if personal data was exposed. Get legal advice promptly.

Final Thoughts

Effective data recovery after a cyber attack follows a simple principle: contain first, understand second, then restore carefully from verified clean backups in priority order. Organisations that practise this before an incident recover faster, spend less and face fewer hard choices. Treat every restore test and tabletop exercise as an investment in the calm, organised response you will want on your worst day.