Ransomware Investigation: What to Establish in the First Week

A ransomware investigation establishes six facts: how the attackers got in, how long they were inside and where they moved, whether they still have access, what data they accessed and took, what they encrypted, and who they are. Each answer drives a decision the business has to make within days. The exfiltration finding decides whether breach notification laws apply, and HHS presumes that ransomware encryption of electronic protected health information is a HIPAA breach unless a low probability of compromise can be shown. A public company's materiality determination starts the SEC's four-business-day clock under Form 8-K Item 1.05. Proof that the attacker is out decides when restoration is safe, and the attacker's identity shapes the sanctions analysis behind any payment decision. Preserve evidence before rebuilding, because reimaged hosts and expired logs take those answers with them.

What must a ransomware investigation establish?

The questions come in a rough order, because early answers shape the later work. Current access and the way in come first, since nothing restored is safe while the attacker can return. Exfiltration comes next, because it decides the legal posture. Attribution runs throughout, because known groups leave known patterns and some carry sanctions risk.

Each row depends on the evidence-handling method described in our guide to cyber forensics: volatile evidence first, hashed copies, and a documented chain of custody.

What should you preserve before you restore?

Restoration and evidence preservation compete for the same machines, and every hour of downtime costs revenue, so the conflict is real. The #StopRansomware Guide from CISA and its partners, updated in September 2023, sets the order: determine which systems were affected and isolate them immediately, power devices down only if they cannot be disconnected from the network, and take a system image and memory capture from a sample of affected devices. Rebuilding everything first destroys the record of how the attacker got in, which is the fact you need before trusting the rebuilt environment.

The preservation list is short and specific. Image a sample of encrypted hosts, every domain controller the attacker touched, and the first host they compromised once you find it, and capture memory from those hosts before any reboot. Export firewall, VPN, proxy, DNS, and EDR telemetry, and raise retention on anything that rolls over. Keep the ransom notes, samples of encrypted files, any malware binaries, and the address of the negotiation portal. Snapshot cloud identity logs, because Microsoft Entra ID keeps sign-in logs for 30 days on P1 and P2 licenses. Then restore into a clean environment, starting with identity services, as our business continuity and disaster recovery guide describes.

How do investigators find the initial access point and lateral movement?

Investigators work backward from the encryption event. The time the ransomware ran, the way it was deployed, and the account that launched it lead to the systems the attacker staged from, and those lead back to the first foothold. The usual entry points are well documented. A joint FBI, CISA, and MS-ISAC advisory on Medusa ransomware from March 2025 describes initial access brokers who phish for credentials and exploit unpatched software, including flaws in ScreenConnect and Fortinet EMS. Coveware's report for the second quarter of 2026 found phishing and social engineering back in the lead among access vectors, with remote access compromise still a material path and compromised credentials rising.

Lateral movement shows up in authentication logs, remote service creation, and remote desktop sessions. Persistence shows up as new accounts, scheduled tasks, services, and remote access tools the company never approved. Dwell time, the period between first access and detection, sets how far back the evidence has to reach. When logs rolled over before the first foothold, the report should say so plainly and give the earliest date the evidence supports.

Was data exfiltrated in the ransomware attack?

In the cases Coveware handled in the second quarter of 2026, exfiltration appeared in 76% of incidents, tied with lateral movement as the most observed tactic. Attackers often stage data in compressed archives first and move it with legitimate tools that blend into normal traffic. CISA advisories document the pattern: the advisory on BianLian reports exfiltration by FTP, Rclone, and the Mega file-sharing service, the advisory on Scattered Spider reports exfiltration to MEGA[.]NZ, and the Medusa advisory reports Rclone moving data to the group's servers. The evidence sits in EDR telemetry showing those tools running, firewall and proxy logs showing large outbound transfers to cloud storage, DNS queries, and cloud audit logs if the data came from SharePoint, OneDrive, or Google Drive.

Leak sites supply the attacker's own account. According to the Medusa advisory, that group runs a .onion data leak site that lists victims alongside countdowns to publication and offers the data for sale before the timer ends. A listing confirms that data left, and the sample files posted with it help scope what. Absence from a leak site proves little, since a group can sell data privately.

The exfiltration finding decides notification because the rules turn on it. The HHS ransomware fact sheet treats encryption of ePHI by ransomware as a breach unless the entity demonstrates a low probability of compromise under a four-factor risk assessment, and it lists whether data was exfiltrated as a consideration. The FTC's Safeguards Rule presumes that unauthorized access to customer information includes acquisition unless the institution has reliable evidence otherwise. State laws differ, and New York's definition, as amended by the SHIELD Act, covers unauthorized access as well as acquisition. Under the HHS and FTC rules the organization carries the burden of showing that data was not compromised or acquired, so missing logs make that showing harder.

Which notification and reporting clocks apply after a ransomware attack?

Several clocks can run at once, and they start on different events: a discovery, a determination, or a payment. The table summarizes the main U.S. regimes as of October 20, 2026. Counsel decides which apply and when each started; the investigation supplies the facts those decisions rest on.

The primary texts are short enough to read with counsel: the SEC's fact sheet on its 2023 cybersecurity disclosure rule, 23 NYCRR 500.17, and the FTC's 2023 Safeguards Rule amendment.

Three details trip companies up. The SEC clock runs from the materiality determination, and the rule requires that determination without unreasonable delay after discovery, so postponing the decision does not postpone the obligation. Item 1.05 remains in effect as of October 20, 2026, although the SEC chairman requested comment on Regulation S-K in January 2026 and trade groups have asked the Commission to rescind the item. And CIRCIA's reporting duties begin only when CISA's final rule takes effect: CISA sent the rule to the White House Office of Management and Budget for review on October 1, 2026, and until it takes effect, CISA describes reporting under CIRCIA as voluntary while encouraging organizations to share incident information.

What does the investigation tell you about paying a ransom?

Whether to pay is a decision for leadership and counsel, and the investigation supplies four facts it depends on. The first is who the attacker is, because OFAC's updated advisory of September 21, 2021 says it may impose civil penalties for sanctions violations on a strict liability basis, so a payment that reaches a sanctioned person can create liability even if the payer did not know. The second is whether backups can restore operations, which decides whether a decryptor matters at all. The third is what was taken, because paying for deletion buys a promise, and Coveware's second-quarter 2026 report notes that LockBit retained victims' stolen data despite promises to delete it. The fourth is whether the attacker is out, since a payment removes no persistence.

The government's position is consistent. OFAC strongly discourages ransom payments and treats meaningful security improvements, a prompt and complete report to law enforcement or CISA, and full cooperation as significant mitigating factors. The FBI, CISA, and MS-ISAC say in their #StopRansomware advisories that they do not encourage paying, because payment does not guarantee recovery and may embolden attackers. FinCEN's November 2021 advisory warns that firms that facilitate ransom payments may need to register as money services businesses and describes financial institutions' suspicious activity reporting duties. For NYDFS-regulated companies, a payment starts its own 24-hour notice and a 30-day written explanation that must describe the diligence performed to comply with OFAC rules.

What do recent ransomware figures show?

Three sources published before October 20, 2026 give the current picture. The FBI's 2025 Internet Crime Report recorded 3,611 ransomware complaints and about $32.3 million in reported losses, and it notes that the loss figure does not normally include lost business, time, wages, files, or equipment; Akira and Qilin led its list of the most reported variants. Coveware's report for the second quarter of 2026, published July 29, 2026, put the average ransom payment at $1,880,612 and the median at $150,000, found the share of victims paying at a record low, and put the payment rate in data-theft-only cases at 15%. Sophos's State of Ransomware 2026, a survey of 2,158 IT and security leaders in 17 countries fielded from January to March 2026, found data encrypted in 56% of attacks, a median payment of $769,000, and an average recovery cost of $1.7 million.

The three sources measure different populations, so the numbers do not reconcile: IC3 counts complaints filed with the FBI, Coveware counts its own cases, and Sophos surveys IT and security leaders. Coveware's data adds the point that matters most for an investigation: attackers took data in most of its cases while fewer victims paid, which puts the exfiltration analysis at the center of the work.

How do counsel, insurers, and law enforcement fit into the investigation?

Counsel belongs on the first call. When an attack is likely to lead to notification decisions or litigation, outside counsel often retains the forensic firm so the work supports legal advice, and our Kovel agreement guide explains that structure and what courts have examined when it was challenged. Privilege calls belong to counsel and, ultimately, the court.

The insurer comes next. If you carry cyber insurance, notify the carrier early and read the policy's notice and consent conditions before you sign vendor contracts, because those terms govern which costs the policy covers. If the carrier assigns breach counsel, sometimes called a breach coach, settle early who retains the forensic firm and who receives its reports, since both choices affect privilege. CISA's ransomware guide lists the cyber insurance company among the stakeholders to keep informed.

Law enforcement is the third call. The CISA guide directs victims to report to CISA or their local FBI field office and to consider the FBI's Internet Crime Complaint Center or a U.S. Secret Service field office. If a payment later raises sanctions questions, OFAC treats a prompt, complete report and ongoing cooperation as significant mitigating factors.

How BD Emerson runs ransomware investigations

We start with access and preservation. On the first call we agree with you and your counsel who directs the work, give your team a preservation list for the hosts, logs, and cloud tenants involved, and confirm the attacker's access is cut before anyone restores. The investigation then runs alongside containment and recovery within our incident response services, so findings about persistence and the access path reach the recovery team while it works.

Our examiners establish the access vector, lateral movement, and exfiltration scope with hashed, documented evidence, and report through counsel when counsel directs the work; the method is described on our digital forensics services page. After the incident, we turn the root cause into specific fixes and a tabletop exercise built on what happened. Companies that want terms, rates, and onboarding settled before an incident can arrange an incident response retainer.

Frequently asked questions

Is a ransomware attack a data breach? It depends on the data and the law. HHS treats ransomware encryption of electronic protected health information as a HIPAA breach unless the organization shows a low probability of compromise through a four-factor risk assessment. The FTC's Safeguards Rule presumes unauthorized access includes acquisition unless reliable evidence shows otherwise, and state laws differ on whether access alone counts. The investigation's findings on what the attacker reached and took decide which rules apply, and counsel makes that call.

How do you know if data was stolen in a ransomware attack? Investigators look for staging and transfer: compressed archives, transfer tools such as Rclone running on servers, large outbound transfers in firewall and proxy logs, connections to cloud storage services such as MEGA, and cloud audit records of bulk downloads. A listing on the group's leak site, with sample files, confirms theft. Missing logs limit what can be proven, which is why log exports start on the first day.

Should we restore from backups before the investigation is finished? Restore once the attacker's access is cut and evidence from a sample of affected systems is preserved. CISA's #StopRansomware Guide recommends a system image and memory capture from a sample of affected devices and warns against reinfecting clean systems during recovery. Restoring into a network the attacker still controls hands the systems back, so restore identity services first, in a clean environment.

Should we report a ransomware attack to law enforcement? The FBI, CISA, and MS-ISAC urge victims to report ransomware incidents promptly to the FBI's Internet Crime Complaint Center, a local FBI field office, or CISA, whether or not they pay. OFAC treats a prompt, complete report and ongoing cooperation as significant mitigating factors if a payment later raises sanctions questions. CIRCIA will require covered entities to report to CISA once its final rule takes effect; as of October 20, 2026, that reporting is voluntary.

Does paying the ransom get stolen data deleted? Payment buys a promise, and attackers have broken it. Coveware's report for the second quarter of 2026 notes that LockBit retained victims' stolen data despite promises to delete it, and the FBI, CISA, and MS-ISAC say payment does not guarantee recovery. Whether to pay is a decision for leadership and counsel, and the investigation's findings on what was taken and who took it should inform it.

What does OFAC say about ransomware payments? OFAC's updated advisory of September 21, 2021 says the U.S. government strongly discourages ransom payments and that OFAC may impose civil penalties for sanctions violations on a strict liability basis, even when the payer did not know the recipient was sanctioned. It treats meaningful security improvements, a prompt and complete report to law enforcement, and full cooperation as significant mitigating factors. Identifying the threat actor is part of the sanctions analysis counsel performs before any payment.

If you are in the first week of a ransomware attack, our incident response team can preserve the evidence, establish the access path and the exfiltration scope, and give your counsel the facts the notification and payment decisions depend on.