--- title: "Ransomware Recovery: A Business Owner's Guide to Getting Back to Work" description: Learn essential steps for ransomware recovery, including immediate actions, the importance of backups, and how to create a recovery plan with TMGC. image: https://www.tmgcinc.com/hubfs/ransomware%20recovery.webp --- [Skip to the main content.](https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide#main-content) [![TMGC\_Logo\_Main\_V1](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1.webp?width=130&height=112&name=TMGC_Logo_Main_V1.webp "TMGC_Logo_Main_V1")](https://www.tmgcinc.com/) [![TMGC\_Logo\_Main\_V1](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1.webp?width=150&height=129&name=TMGC_Logo_Main_V1.webp "TMGC_Logo_Main_V1")](https://www.tmgcinc.com/) - [Fractional IT Services](https://www.tmgcinc.com/fractional-it-services) - What We Do - [Complete IT Management](https://www.tmgcinc.com/fractional-it-services) - [Cybersecurity](https://www.tmgcinc.com/managed-cybersecurity-services) - [Service Desk](https://www.tmgcinc.com/it-help-desk-services) - [Data Protection & Recovery](https://www.tmgcinc.com/data-backup-recovery) - [Cloud & Hosting](https://www.tmgcinc.com/managed-cloud-hosting-services) - [Compliance Management](https://www.tmgcinc.com/it-compliance-services) - [IT Infrastructure](https://www.tmgcinc.com/it-infrastructure-management) - [Licensing & Software Management](https://www.tmgcinc.com/it-licensing-management) - [Device Management](https://www.tmgcinc.com/it-device-management) - Industries - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [AEC](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Financial Services](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Defense Contractors](https://www.tmgcinc.com/it-support-defense-contractors) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) - Resources - [About Us](https://www.tmgcinc.com/about) - [Blog](https://www.tmgcinc.com/blog) - [Case Studies](https://www.tmgcinc.com/case-studies) - [Guide to CMMC Compliance](https://www.tmgcinc.com/cmmc-compliance-everything-defense-contractors-need-to-know-in-2026) - [Guide to Workplace AI Security](https://www.tmgcinc.com/workplace-ai-security-guide) - [AI Readiness Quiz](https://www.tmgcinc.com/ai-security-readiness-quiz-tmgc) [GET STARTED](https://www.tmgcinc.com/contact) Toggle Menu Toggle Menu [GET STARTED](https://www.tmgcinc.com/contact) - [Fractional IT Services](https://www.tmgcinc.com/fractional-it-services) - What We Do - [Complete IT Management](https://www.tmgcinc.com/fractional-it-services) - [Cybersecurity](https://www.tmgcinc.com/managed-cybersecurity-services) - [Service Desk](https://www.tmgcinc.com/it-help-desk-services) - [Data Protection & Recovery](https://www.tmgcinc.com/data-backup-recovery) - [Cloud & Hosting](https://www.tmgcinc.com/managed-cloud-hosting-services) - [Compliance Management](https://www.tmgcinc.com/it-compliance-services) - [IT Infrastructure](https://www.tmgcinc.com/it-infrastructure-management) - [Licensing & Software Management](https://www.tmgcinc.com/it-licensing-management) - [Device Management](https://www.tmgcinc.com/it-device-management) - Industries - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [AEC](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Financial Services](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Defense Contractors](https://www.tmgcinc.com/it-support-defense-contractors) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) - Resources - [About Us](https://www.tmgcinc.com/about) - [Blog](https://www.tmgcinc.com/blog) - [Case Studies](https://www.tmgcinc.com/case-studies) - [Guide to CMMC Compliance](https://www.tmgcinc.com/cmmc-compliance-everything-defense-contractors-need-to-know-in-2026) - [Guide to Workplace AI Security](https://www.tmgcinc.com/workplace-ai-security-guide) - [AI Readiness Quiz](https://www.tmgcinc.com/ai-security-readiness-quiz-tmgc) [Linkedin](https://www.linkedin.com/company/the-millennium-group-computing/) 6 min read # Ransomware Recovery: A Business Owner's Guide to Getting Back to Work [Tony DiDonato](https://www.tmgcinc.com/blog/author/tony-didonato) : October 30, 2026 [Ransomware Recovery](https://www.tmgcinc.com/blog/tag/ransomware-recovery) ![Ransomware Recovery: A Business Owner's Guide to Getting Back to Work](https://www.tmgcinc.com/hubfs/ransomware%20recovery.webp) I've been doing IT since before Y2K, and I've walked clients through ransomware recovery more times than I'd like. The businesses that come out of it in days instead of months have three things in common: a plan, backups an attacker couldn't reach, and someone who knew what to do first. Ransomware recovery starts way [before an attack is attempted](https://www.tmgcinc.com/fractional-it-services), but if you reach that scary moment when someone on your team notices files won’t open, there’s still some important steps to take to limit the damage. This guide is the starting point for our ransomware recovery series. It covers what to do in the first 24 hours, how long recovery takes, why backups decide the outcome, and what belongs in a ransomware recovery plan.   ## **Key Takeaways** - 53% of U.S. businesses hit by ransomware recovered within a week, and 24% needed one to six months - The average U.S. recovery cost reached $2.51 million in 2026, not counting any ransom - Attackers went after backups in 94% of ransomware attacks and succeeded 57% of the time - Only 16% of organizations say their backup storage meets the standard for true immutability   ## **Table of Contents** 1. [What Is Ransomware Recovery?](https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide#what) 2. [What Should You Do in the First 24 Hours?](https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide#first-24) 3. [Should You Pay the Ransom?](https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide#pay) 4. [How Long Does Ransomware Recovery Take?](https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide#long) 5. [Why Your Backups Decide How Recovery Goes](https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide#backups) 6. [What Order Should You Restore Systems In?](https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide#order) 7. [What Goes in a Ransomware Recovery Plan?](https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide#plan)   ## **What Is Ransomware Recovery?** Ransomware recovery covers what you as a business owner do between detecting an attack and running normally again: isolating infected systems, figuring out how the attacker got in, removing them, restoring data from clean backups, and putting fixes in place so it doesn't happen twice. Restoring files is one step in that process, and usually not the longest one. Plenty of businesses restore their files and get hit again within weeks because the attacker still had a way in. Sophos found that [69% of U.S. ransomware incidents](https://assets.sophos.com/X24WTUEQ/at/tsttpn5wtvfzjw7f4cn89/sophos-state-of-ransomware-in-us-2026.pdf) were tied to the same event as the organization's most serious identity attack. A stolen login is usually part of the story, and recovery isn't finished until that login is shut down.   ## **What Should You Do in the First 24 Hours?** The first 24 hours are crucial to stop the spread and protect your options. [CISA's guidance](https://www.cisa.gov/stopransomware/ive-been-hit-ransomware) is to isolate affected systems immediately, report the attack, and preserve evidence before you start restoring anything. Moving too fast on the restore is one of the most common ways businesses end up re-infected. Here's the steps I recommend every business takes: 1. **Disconnect affected machines:** Unplug them from the network or turn off Wi-Fi. If several systems look affected, take the network offline at the switch. 2. **Don't power everything off unless you have to:** CISA recommends shutting down only if you can't disconnect a device another way, because powering off erases evidence investigators may need. 3. **Use a phone, not email:** Attackers may be watching your inbox. Coordinate by phone or text until you know email is clean. 4. **Call your** [**IT partner**](https://www.tmgcinc.com/fractional-it-services) **and your cyber insurer:** Many policies require you to notify the carrier quickly and use approved responders. Your broker can tell you what your policy expects. 5. **Report it:** File with the [FBI's Internet Crime Complaint Center](https://www.ic3.gov/) or your local FBI field office. Law enforcement sometimes has decryption keys for known strains. 6. **Lock down accounts and remote access:** Reset admin passwords, disable VPN and remote desktop access that could let the attacker back in, and revoke active sessions. 7. **Write everything down:** What you saw, when, and what you did. Your [cyber insurer](https://lakeside-insurance.com/business-insurance/cyber-liability-insurance/) and investigators will ask. If you've ever been through [business email compromise](https://www.tmgcinc.com/blog/business-email-compromise-arent-we-more-advanced-than-that) or a [session hijacking](https://www.tmgcinc.com/blog/what-is-session-hijacking) incident, a lot of this will feel familiar. The difference with ransomware is that the clock on your operations is already running.   ## **Should You Pay the Ransom?** Paying is a business decision, and it's a bad bet more often than owners expect. The FBI [does not support paying a ransom](https://www.fbi.gov/contact-us/field-offices/nashville/news/fbi-memphis-field-office-reminds-tennesseans-about-the-risk-of-ransomware), because payment doesn't guarantee you'll get your data back and it funds the next attack. Paying also doesn't guarantee stolen data stays private. That second point has played out publicly. When law enforcement took down the LockBit ransomware group, investigators found it had [kept victims' stolen data despite promising to delete it](https://coveware.com/2026/07/adverse-cyber-extortions-are-more-common-than-commonly-advised/) after payment. Even among U.S. businesses that paid in 2026, the median payment was [$1 million](https://assets.sophos.com/X24WTUEQ/at/tsttpn5wtvfzjw7f4cn89/sophos-state-of-ransomware-in-us-2026.pdf), and paying didn't skip the cleanup. You still need to find how they got in, remove them, and rebuild. The best way to stay out of that decision is to have backups good enough that you never need to consider it. We'll go deeper on the tradeoffs in an upcoming post in this series. Here's how the three paths usually compare:   | **Recovery Path** | **How Fast** | **What It Risks** | | --- | --- | --- | | Restore from clean, offline backups | Days for most businesses with tested backups | Losing changes made since the last good backup | | Pay for a decryption key | Unpredictable; decryptors are often slow or partially broken | The money, leaked data anyway, and being marked as a business that pays | | Rebuild without usable backups | Weeks to months | Permanently lost data, missed deadlines, and lost clients |   ## **How Long Does Ransomware Recovery Take?** Recovery time depends on how much was encrypted, where your clean copy lives, and whether anyone has practiced the restore. Sophos found 53% of U.S. businesses recovered within a week in 2026, while 24% needed one to six months. That gap is growing. Other research is less encouraging. In an Omdia study, only [39% of organizations recovered at least 75% of their data](https://www.storagenewsletter.com/2026/09/03/object-first-sponsored-omdia-research-93-of-technology-leaders-say-absolutely-immutable-backup-storage-is-critical-for-ransomware-protection-but-only-16-have-it/) after an attack, down from 57% in 2024. And 64% had an outage that ran longer than the downtime they'd planned for. Cost tracks with time. The average U.S. recovery cost hit $2.51 million in 2026, up from $1.91 million the year before. That figure covers downtime, staff hours, replacement devices, and lost business. It doesn't include the ransom.   ## **Your Backups Decide How Recovery Goes** [Data backups](https://www.tmgcinc.com/data-backup-recovery) are the single biggest factor in how ransomware recovery goes. In 2026, 60% of U.S. businesses used backups to recover encrypted data, up from 43% the year before. The ones who couldn't were left choosing between paying and rebuilding. Attackers know this, so they go after your backups first. Sophos found attackers [tried to compromise backups in 94% of attacks](https://www.sophos.com/en-us/blog/the-impact-of-compromised-backups-on-ransomware-outcomes) and succeeded 57% of the time. When backups were lost, median recovery costs jumped from $375,000 to $3 million. The fix is backup copies an attacker can't reach or change. That's what "immutable" means: once a backup is written, nobody can edit or delete it for a set period, including someone using your admin login. Here's how common backup setups hold up during an attack:   | **Backup Setup** | **What Ransomware Does** | **Recovery Outlook** | | --- | --- | --- | | External drive or NAS on your office network | Encrypt or wipe it along with everything else | Poor; often the first thing attackers find | | Cloud sync (OneDrive, Dropbox, SharePoint) | Sync encrypted files over good ones on every device | Limited; built-in restore windows are short | | Off-site backups reachable with your admin login | Delete them using stolen credentials | Depends on whether the attacker found them | | Off-site, immutable backups managed separately | Nothing; copies can't be changed or deleted | Strong, as long as restores are tested |   We saw how this plays out in architecture firms in our post on [what happens when ransomware hits CAD and BIM files](https://www.tmgcinc.com/blog/bim-security-withstand-ransomware-attack). The same rules apply to accounting data, ERP systems, and anything else your business runs on. If you want to see how we handle it, our [data backup and recovery](https://www.tmgcinc.com/data-backup-recovery) page walks through the setup.   ## **What Order Should You Restore Systems In?** Restore in the order your business needs to function, starting with the systems everything else depends on. Bringing back a file share before the system that controls logins can mean restoring files nobody can safely open. A typical order looks like this: 1. **Identity and core infrastructure:** Domain controllers, Microsoft 365 admin access, firewalls, and anything that controls who can log in. 2. **Systems that bring in or move money:** Accounting, payroll, invoicing, and your ERP or job cost system. 3. **Active work:** Project files, customer records, and anything tied to a deadline this week. 4. **Email and communication tools:** Once you've confirmed accounts are clean. 5. **Everything else:** Archives, older projects, and nice-to-haves. Before any system goes back into use, it needs to be checked. CISA's guidance is to rebuild from clean images and restore from offline backups [without reinfecting clean systems](https://www.cisa.gov/stopransomware/ive-been-hit-ransomware). Skipping that step is how a three-day recovery turns into a three-week one.   ## **What Goes in a Ransomware Recovery Plan?** A ransomware recovery plan is a short written document that tells your team exactly what to do, who to call, and what comes back first when an attack hits. Keep it short, and make it specific enough that nobody is making these decisions for the first time when a disaster strikes. Every plan should cover: - **Who's in charge:** One decision-maker, plus a backup if they're unreachable - **Contact list:** Your IT partner, cyber insurer, broker, attorney, bank, and FBI field office, with phone numbers stored somewhere other than your email - **Critical systems list:** What has to come back first, and who depends on each system - **Recovery targets:** How long each system can be down (your RTO) and how much data you can afford to lose (your RPO) - **Backup details:** Where backups live, how often they run, and who can restore them - **Communication plan:** What you'll tell employees, customers, and partners, and who says it - **Payment controls:** How you'll verify any change to bank details while systems are compromised We're building a free ransomware response plan template as part of this series. In the meantime, our partners at [Lakeside Insurance](https://lakeside-insurance.com/business-insurance/cyber-liability-insurance/) can tell you what your cyber policy requires you to have documented. With our [fractional IT services](https://www.tmgcinc.com/fractional-it-services), backups, monitoring, recovery planning, and restore testing are all part of one flat monthly rate, so you're never paying a project bill on the worst day of your year. If you want to know how your business would hold up, [let's talk](https://www.tmgcinc.com/contact).   Our Story Our Story Started in 1999, The Millennium Group Computing is a proud veteran-owned business that is a complete technology solution provider. We are 100% committed to making sure business owners have the most reliable and professional IT service in Denver Metro. Our team of talented IT professionals can solve your IT nightmares once and for all. ###### ![](https://www.tmgcinc.com/hs-fs/hubfs/Logos/TMGC_Logo_Main_V1%20(1).webp?width=125&height=108&name=TMGC_Logo_Main_V1%20(1).webp) Who We Serve Who We Serve - [Manufacturing](https://www.tmgcinc.com/managed-it-services-manufacturing) - [Engineering](https://www.tmgcinc.com/architecture-engineering-construction-it-services) - [Defense & Govcon](https://www.tmgcinc.com/it-support-defense-contractors) - [Financial](https://www.tmgcinc.com/it-support-financial-services) - [Medical](https://www.tmgcinc.com/managed-it-services-medical-practices) - [Private Equity](https://www.tmgcinc.com/it-services-private-equity) Resources Resources - [TMGC Blog](https://www.tmgcinc.com/blog) - [About Us](https://www.tmgcinc.com/about) - [Contact Us](https://www.tmgcinc.com/contact) - [Support](https://www.tmgcinc.com/customer-support) - [Contact Us](https://www.tmgcinc.com/contact) - [Support](https://www.tmgcinc.com/customer-support) - [Privacy Policy](https://www.tmgcinc.com/privacy-policy) © 2026 The Millennium Group Computing - Denver's Leader In IT Tech Services [Linkedin](https://www.linkedin.com/company/the-millennium-group-computing/) *Designed by [Warden Strategy](https://www.wardenstrategy.com/)* Return to top ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Tony DiDonato", "url" : "https://www.tmgcinc.com/blog/author/tony-didonato" }, "dateModified" : "2026-10-30T17:49:41.570Z", "datePublished" : "2026-10-30T17:49:41.000Z", "headline" : "Ransomware Recovery: A Business Owner's Guide to Getting Back to Work", "image" : [ "https://www.tmgcinc.com/hubfs/ransomware%20recovery.webp" ], "mainEntityOfPage" : { "@id" : "https://www.tmgcinc.com/blog/ransomware-recovery-business-owners-guide", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.tmgcinc.com/hubfs/TMGC_Logo_Main_V1.webp" } } } ```