When ransomware has hit, what key decisions does an organisation suddenly face?
How to find out what happened, who to mobilise, how to keep operating, what to report — and whether to pay.
* The decision fan an organisation faces the moment ransomware lands — scope, crisis command, operations, legal duty, and the pay-or-not call. *
These "what now?" questions map directly onto a real incident-response plan:
- Discover scope: how do we even find out what happened and how far it spread?
- Mobilise a crisis team: convene management/board (Krisenstab, GL, VR)
- People & operations: how do we inform staff — can they still work, should they come in?
- Legal duty: is there a reporting obligation to authorities/regulators? (In Switzerland, certain incidents must be reported; under GDPR, breaches of personal data within 72 hours.)
- Pay the ransom? If yes, how (and is it even legal)? If no, what happens to the leaked data?
The lesson: these decisions are far too consequential to improvise mid-crisis. You need a prepared incident-response plan, tested backups, and clear escalation paths before the attack — and security is the three pillars again: technology, process, and people.
Tip: Authorities generally advise against paying — it funds crime, marks you as a payer, and never guarantees recovery or deletion of stolen data.
Go deeper:
GDPR (Wikipedia) — Article 33 requires notifying the supervisory authority of a personal-data breach within 72 hours.- Ransomware (Wikipedia) — context for the pay-or-not decision — payment trends and why authorities advise against it.