Ransomware in Malta: what actually happens in the first 24 hours

Most articles on ransomware are written before it happens to you — prevention checklists, "top 10 tips." This one is written for the version of you reading it at 7am with a locked screen and a ransom note, because that's when the actual questions get asked, and the answers matter more than any checklist did the day before.

Here's what a first 24 hours actually looks like, based on what we've seen respond to incidents for Maltese SMEs — not the theoretical version.

Hour zero: what you'll actually see

Usually it's not subtle. Files with a strange new extension, a ransom note appearing as a text or HTML file in every folder, or an entire desktop background replaced with instructions. Sometimes it's quieter — a server unresponsive, backup jobs silently failing for days before anyone notices, and the ransom note only appearing once the encryption completes.

The first reaction is almost always the wrong one: trying to fix it yourself, rebooting affected machines, or — worst of all — paying immediately out of panic before anyone has assessed the actual damage.

The first hour: contain, don't fix

Isolate, don't power off. Disconnect affected machines from the network — pull the cable, disable Wi-Fi — but don't shut them down. Powering off can destroy forensic evidence and volatile memory that helps identify what happened and how.

Stop it spreading. If it's hit one machine, assume it's trying to hit others. Segment the network where you can — disable shared drives, isolate the affected VLAN, disconnect backup targets from the live network if they're still reachable.

Don't touch the ransom note beyond reading it. It usually identifies the ransomware family, which matters for the next step — some strains have known decryption tools; most don't.

Call your incident response contact, not your regular helpdesk queue. This is the moment a defined incident response plan (or a supplier who has one) earns its cost. If you don't have one, this is when you find out the hard way.

Hours two to six: assessment

This is where the real work happens, and it's slower than people expect, because doing it wrong compounds the damage.

Scope of compromise: which systems are affected, and — critically — whether the attacker had access before the encryption event triggered. Ransomware deployment is often the final, loud stage of an intrusion that began days or weeks earlier.

Backup integrity check: are your backups clean, current, and were they reachable from the compromised network? This is the single question that determines whether the rest of the day is "restore and recover" or "negotiate and hope."

Data exfiltration check: modern ransomware groups frequently steal data before encrypting it, turning this into a data breach as well as an availability incident — which has separate legal and notification obligations.

Hours six to twenty-four: the decisions

If backups are clean: the path is recovery, not negotiation. Rebuild affected systems from known-clean images, restore data from backup, and only reconnect systems to the network once they've been verified clean — not just restored.

If backups are compromised or absent: this is the conversation nobody wants to have. Paying a ransom doesn't guarantee decryption, funds further attacks, and in some cases carries its own legal exposure depending on the sanctioned status of the group involved. It should never be the first option considered, and ideally involves specialist negotiators rather than a direct response from the business.

Regulatory and legal obligations. If personal data may have been exfiltrated, Malta's Information and Data Protection Commissioner has notification requirements under GDPR, typically within 72 hours of becoming aware of a breach. This clock starts earlier than most businesses realise — get legal advice on this within the first day, not the first week.

Client and stakeholder communication. Silence looks worse than an honest, early "we're aware of an incident and are responding" — but get legal input before anything goes out in writing.

Why the businesses that recover fastest all have one thing in common

It's never luck. It's clean, tested, offline or immutable backups — meaning backups the ransomware itself couldn't reach or encrypt — combined with a response plan that was written and rehearsed before the incident, not improvised during it. Everything else in the first 24 hours is damage control around that one fact.

Frequently asked questions

Should we ever pay the ransom?

It should be a last resort, decided with legal and specialist input, never as a first reaction. Payment doesn't guarantee data recovery and has documented cases of double extortion even after payment.

How long does full recovery typically take?

Highly variable — a well-backed-up small business can often be substantially operational within days; a business without clean backups or with a large, complex environment can take weeks.

Is this covered by cyber insurance?

Often partially, but policies vary significantly on what's included — incident response costs, business interruption, ransom payment itself (increasingly excluded or restricted). Check your policy before you need it, not during the incident.

What's the single most useful thing we could do before an incident happens?

Test your backup restore process, not just the backup job itself. A backup that's never been test-restored is a hope, not a plan.

---

eMerge provides managed cybersecurity, backup and incident response support for SMEs across Malta. If you don't have a tested incident response plan, that's the conversation worth having now — before 7am, not after.