Data Recovery After Ransomware Attacks: Best Practices & Checklist

First, the good news: more and more organisations are restoring their data from backups following a ransomware attack, rather than paying the ransom. According to Sophos’ State of Ransomware 2026, 66 per cent of organisations with encrypted data managed to do so, up from 54 per cent the previous year. The proportion of ransom payments fell to 48 per cent, the lowest figure in three years. The survey polled 2,158 companies across 17 countries in the first quarter of 2026 (Sophos State of Ransomware 2026).

The picture is much the same in the DACH region, with one caveat. In Germany, 61 per cent of affected organisations restored their data using backups, but only 60 per cent were back up and running within a week. For 12 per cent, it took between one and six months. Recovery cost an average of 1.42 million US dollars, excluding ransom payments (Sophos: Ransomware in Germany 2026).

Backups are therefore the most important tool for data recovery following a ransomware attack, and for this very reason they are a target. In 2025, Mandiant observed that groups such as Akira and Qilin specifically targeted backup infrastructure, identity services and virtualisation platforms, and were deleting backup objects from cloud storage (Mandiant M-Trends 2026). Following an attack, therefore, the backup is not an automatic lifeline, but rather a piece of evidence. It is checked before it is allowed back onto the network.

Identifying compromised data: reconstruct first, then restore

Encrypted systems are obviously affected. More dangerous are systems that appear normal but already contain backdoors, new admin accounts or manipulated configurations. This is all the more true given that, according to Sophos, 79 per cent of ransomware attacks in 2026 began with an identity-based approach, such as via compromised login credentials. Anyone logging in with valid accounts is less likely to be detected in the logs than obvious malicious code.

In incident response, five verification steps have proven effective:

• Forensic timeline: Analyse logs from SIEM, EDR, firewalls and identity services to reconstruct the initial access and movements within the network.

• IoC comparison: Search specifically for the Indicators of Compromise (IoCs) of the relevant ransomware family – file hashes, C2 communication, scheduled tasks, new services and other persistence mechanisms.

• Integrity check: Compare files, images and configurations using hashes against known, unaltered reference values.

• Isolated analysis environment: Never deploy suspicious backups and images directly into the production network; instead, launch and check them first in a segregated quarantine environment.

• Backup verification for malicious code: The BSI puts it in no uncertain terms: “Before restoration, it should be checked whether the backups might already be infected with malware.” This is done using copies of the backups or a write blocker (BSI: Catalogue of measures against ransomware).

The US agency CISA also warns against overlooking dropper malware before rebuilding systems from backups, otherwise the compromise will simply continue (CISA: #StopRansomware Guide).

Finding the ‘clean’ restore point: before the initial access, not before the encryption

Many organisations automatically assume that the last backup taken before the encryption became visible is ‘clean’. However, in between lies the dwell time – that is, the period during which attackers remain undetected on the network. According to Mandiant, the global median dwell time in 2025 was 14 days, up from 11 days the previous year (Mandiant M-Trends 2026). ‘Median’ means that in half of the cases, it took longer. Anyone reverting to yesterday’s backup risks bringing the attacker back with them.

This is how a robust recovery point is created:

1. Determine the initial access: Forensic analysis establishes when the attacker first gained access to the network.

2. Narrow down the candidates: Backups taken before this point are considered candidates and are not approved.

3. Verify each candidate in isolation: Launch the snapshot in the quarantine environment and examine it for unknown processes, accounts, services and altered configurations.

4. Cross-check identities: Analyse Active Directory, Certificate Services and service accounts separately. Mandiant describes how attackers exploit misconfigured Active Directory Certificate Services templates to create administrator accounts that survive password rotation. A clean file system is of little use if the domain remains compromised.

5. Document the results: Each recovery point checked is recorded along with the audit result. This ensures traceability for auditors, regulatory authorities and cyber insurers.

A clean recovery point is therefore not simply a date from the backup console, but the result of a check.

Secure system recovery: phased and monitored

Once the recovery point has been approved, the second critical phase begins. Time pressure is then intense: According to Sophos, in 2026, recovery from ransomware took an average of three weeks globally (Sophos State of Ransomware 2026). A complete one-off restore might seem tempting. In practice, however, it immediately reactivates any overlooked backdoor across the entire network.

• Restore in stages: Start with the core systems, following a predefined list of critical assets, as recommended by CISA. Initially, these should be segmented and have restricted user access.

• Renew access credentials: Reset passwords for all affected systems, service accounts, certificates and keys. The password reset is explicitly mentioned in the CISA checklist (CISA: #StopRansomware Guide). In the case of identity-based attacks, this step is non-negotiable.

• Step up monitoring: Intensify EDR/MDR and SOC monitoring during the initial operational phase; escalate suspicious cases immediately.

• Involve specialist departments: The specialist departments must confirm that each application is functioning correctly before further systems are rolled out.

• Evaluate lessons learnt: Analyse the attack vector, response times and process gaps. The BSI recommends revising the response plan after every incident.

The recovery process is only complete once the critical systems have been running stably and without anomalies for several operating days and the forensic team has authorised operations to resume.

Ransomware contingency plan: Checklist for rapid data recovery

Whether ransomware recovery is successful is largely decided before the attack. These points should be included in every contingency plan:

• Escalation procedures and responsibilities are defined: IR team, senior management, legal, data protection, communications.

• Reporting obligations and deadlines are documented, for example in accordance with the GDPR and – where the organisation is affected – with NIS2.

• At least one backup copy is stored offline, and the isolation of this copy is checked regularly (BSI); this is based on the 3-2-1 rule.

• The backup environment is decoupled from the company’s Active Directory and uses immutable storage, as recommended by Mandiant.

• Restorations are regularly tested in practice, including a cold start of all servers and systems.

• A list of critical assets determines the order of restart.

• An isolated analysis and recovery environment has been set up.

• Communication templates for staff, customers, partners and regulatory authorities are in place.

• Access to external incident response expertise is contractually regulated and agreed with the cyber insurer.

FAQ