Incident Playbook — Ransomware¶
One page, for reading during an incident. The full process is the Incident Response Procedure; this is the scenario-specific part.
What this looks like at Soon¶
Soon has no offices, no file servers and no Windows estate. The realistic ransomware is one founder's laptop — encrypted files, a ransom note, and their cloud sessions live.
The laptop is rarely the real problem. No customer data lives on it at rest. What matters is that the person owning that laptop holds credentials to AWS, GitHub, Google Workspace and Enpass. Treat this as a credential compromise that happens to involve encryption, and the priorities fall out correctly.
Detection signals¶
- A ransom note, or files renamed/unopenable
- Endpoint protection alerting on a laptop
- GuardDuty findings on unusual API activity → security@soon.works and Slack
#Security - Unexpected MFA prompts, or sign-ins from unfamiliar locations
- Sentry or CloudWatch showing unexplained mass operations
First 30 minutes¶
| # | Action | Who |
|---|---|---|
| 1 | Disconnect the device from the network. Do not power it off — memory evidence is lost, and modern ransomware finishes encrypting on shutdown | Whoever notices |
| 2 | Declare. Slack #Security, Linear issue labelled security, start a timeline |
Whoever notices |
| 3 | Revoke that person's sessions and rotate their credentials — AWS, GitHub, Google Workspace, Slack, Enpass master. Assume everything they could reach is compromised | Thomas |
| 4 | Check for lateral movement: CloudTrail for unusual API calls, GitHub audit log for pushes and token creation, Workspace login audit | Thomas |
| 5 | Confirm backups are intact and isolated. The vault is in the log-archive account behind an SCP; verify it has not been touched | Melvin |
Then¶
- Do not pay, and do not decide alone. Payment is a management decision involving all four founders, and it may itself be unlawful depending on the actor. Assume the answer is no.
- Rebuild the laptop from scratch. Do not clean it. Restore data from cloud sync only after confirming the sync itself is not carrying encrypted files.
- Was customer personal data reachable? If the person had production database access, this becomes a potential personal data breach — start the breach notification procedure in parallel. It has its own 72-hour clock and does not wait for this one.
- Preserve evidence before rebuilding: the ransom note, sample encrypted files, relevant logs.
Key contacts¶
Olaf (declare, communicate) · Thomas (credentials, investigation) · Melvin (backups, infrastructure) · security@soon.works · Andrea/CyberSquad for advice.
If Google Workspace is affected, Slack goes with it — Slack authenticates through Workspace. Fall back to personal phones. Keep the numbers offline.
Related documents¶
Change log¶
| Version | Date | Author | Comments |
|---|---|---|---|
| 0.1 | 2026-08-22 | ISMS | First version — written for Soon's actual estate (BYOD laptops, no servers), treating the scenario as credential compromise first. |