When the Screens Go Black: 6 Rules for a Cyberattack Plan Before Ransomware Stops Your Business

On the morning of September 1, 2025, Jaguar Land Rover shut down its computer systems, and with them its factories in Solihull, Halewood and Wolverhampton. The plants stayed dark for roughly five weeks. The company later booked £196 million of direct costs linked to the attack, the UK government stepped in with a £1.5 billion loan guarantee to protect the supply chain, and the Cyber Monitoring Centre estimated the total cost to the British economy at about £1.9 billion, making it the most economically damaging cyber incident in UK history.

Four months earlier, Marks & Spencer had lived its own version. Over the Easter weekend of 2025, attackers got into its systems, and M&S paused online orders for about seven weeks. The company warned the incident would cost it around £300 million of operating profit.

Neither company was small, careless or underfunded. A cyberattack is no longer an IT event; it is an operating event that decides whether you can ship, invoice and pay people next week. Our group has run businesses since 1890, today across eight verticals and more than 75 countries, and the lesson from these cases is the same one we apply to fires, floods and recalls: the plan has to exist before the crisis, written by the people who will have to run it. These are the six rules I would put in place before the screens go black.

Why owners underestimate the operating cost of a cyberattack

Most owners picture a cyberattack as a data problem: stolen files, an embarrassing letter to customers, a fine. The modern ransomware attack is different. The attackers encrypt the systems that run the business itself: ordering, warehouse management, production scheduling, payroll, email.

The ransom is rarely the largest cost. The largest cost is downtime. Coveware, an incident-response firm that tracks ransomware cases, has for years reported average downtime of around three weeks per incident. Three weeks without invoicing is a working capital event for almost any company.

• Revenue stops the moment you cannot take or fulfil orders.
• Costs continue: wages, rent, debt service and suppliers who still expect to be paid.
• Customers leave: a retailer that cannot get your product for a month will find someone else, and some never come back.

Price the risk in weeks of lost gross margin, not in the size of the ransom demand. That number belongs in the board pack, next to the bank covenants.

Rule 1: Map what has to keep running, in business terms

Start with operations, not technology. Ask each manager one question: if every computer in the building stopped tomorrow, what would we have to keep doing, and how?

For a winery the answer is not the same as for a hotel or an electrical installer. Harvest does not wait. Guests still arrive with a reservation. A crew still has to know which site to go to on Monday. The output of this exercise is a short list of critical processes, each with an owner and a maximum tolerable outage measured in hours or days.

This is the same discipline I described in our article on single-source supplier risk: find the point where one failure stops everything, and decide in advance what the fallback is.

Rule 2: Keep one copy of everything the attacker cannot reach

The 3-2-1 rule is the oldest advice in backup: three copies of your data, on two different media, one of them off-site. Against ransomware, add one more condition. At least one copy must be offline or immutable, because attackers now look for your backups first and encrypt or delete them before they trigger the attack.

Maersk learned this in 2017, when the NotPetya malware wiped its network and stopped container terminals around the world. As reported by Wired, the company rebuilt thousands of servers and tens of thousands of PCs in about ten days, but its recovery depended on a single domain controller in Ghana that happened to be offline during a power outage. Maersk put the total cost at $250 million to $300 million. A copy that survives by luck is not a plan.

Two practical tests:

• Restore something every quarter, end to end, and time it. A backup you have never restored is a hope, not a backup.
• Ask who can delete the backups. If the answer is "anyone with the main admin password," one stolen password ends your recovery.

Rule 3: Write the paper playbook for the first 72 hours

When the network is down, your plan cannot live on the network. Print it. Keep copies in the office safe and at the homes of the people who will lead the response.

The first 72 hours decide most of the cost, and nobody makes good decisions while looking for a phone number. The playbook should fit on a few pages:

• Who decides: one incident leader and a deputy, with authority to shut systems down without waiting for a meeting.
• First actions: isolate infected machines, disconnect from the internet if needed, preserve evidence, do not wipe anything yet.
• Who to call: your incident-response firm, your insurer's hotline, your lawyer, your bank, and law enforcement (in the US, the FBI; in Spain, INCIBE's 017 line).
• Phone numbers on paper: key staff, top customers, critical suppliers and the IT provider, because your email and contact lists may be encrypted.

Rule 4: Decide your ransom position before anyone is under pressure

Whether to pay is a business decision made under the worst possible conditions: systems down, staff anxious, a countdown on the screen. Make the decision framework in advance, with your board or family council, while everyone is calm.

The facts to put on the table: the FBI discourages payment; paying does not guarantee you get working decryption keys or that stolen data is deleted; and in the United States, the Treasury's Office of Foreign Assets Control has warned that paying a sanctioned group can itself be a violation. Some jurisdictions now restrict public bodies from paying at all.

The strongest ransom position is not "never pay" or "always pay"; it is a recovery capability good enough that paying is unnecessary. That is why Rule 2 comes first.

Rule 5: Read the cyber insurance policy before you need it

The question "Does JLR have cyber insurance?" became one of the most searched questions about the attack, after widespread reports that the company had no cyber policy in place when it was hit. Insurance does not prevent an attack, but it can fund the response team, the forensic work and part of the lost income.

Read three things in the policy, with your broker, before renewal:

• What is covered: business interruption, extortion, data restoration, legal and notification costs, and the waiting period before interruption cover starts.
• What the insurer requires: many policies now demand multi-factor authentication, offline backups and endpoint protection. If you do not have them, a claim can be denied.
• Whose response team you must use: most policies give you a panel of approved incident-response firms. Put that hotline in the paper playbook.

A policy you have never read is a premium, not protection.

Rule 6: Rehearse it once a year, with the leadership team in the room

Plans fail at the joints between people. A tabletop exercise, two or three hours with a facilitator walking the leadership team through a realistic scenario, reveals those joints cheaply: the manager who does not know they have authority, the supplier contract nobody can find, the customer communication nobody approved.

Run it like the crisis framework we use for any major disruption: one leader, clear roles, a fixed rhythm of updates, and honest communication with employees and customers. Communicate early, say what you know and what you do not, and never promise a restart date you cannot keep. Both M&S and JLR published regular updates for customers and suppliers during their outages, and that is the standard to copy.

After each rehearsal, update the playbook and the critical-process list. Businesses change; plans that do not change with them become fiction.

Key Takeaways

• A ransomware attack is an operating event: the biggest cost is weeks of downtime, not the ransom.
• Map critical processes in business terms, each with an owner and a maximum tolerable outage.
• Keep at least one backup copy offline or immutable, and prove you can restore it every quarter.
• Print a 72-hour playbook with decision rights, first actions and phone numbers on paper.
• Agree your ransom position calmly in advance; the best position is not needing to pay.
• Read your cyber insurance policy, its requirements and its approved responders before renewal.
• Rehearse once a year with the leadership team and update the plan after every exercise.

Frequently Asked Questions

What is the first course of action after a ransomware attack?

Isolate the affected systems to stop the attack from spreading, then call your incident-response provider and your insurer's hotline. Do not wipe or rebuild machines yet, because you need the evidence to understand how the attackers got in. Activate your paper playbook so one named leader takes control.

What is the 3-2-1 rule for ransomware?

Keep three copies of your data, on two different types of media, with one copy stored off-site. Against ransomware, at least one copy should also be offline or immutable so attackers cannot encrypt or delete it. Test restores regularly, because an untested backup often fails when you need it.

Should a company pay the ransom?

Law enforcement, including the FBI, discourages payment because it funds criminals and does not guarantee recovery or deletion of stolen data. Paying a sanctioned group can also create legal exposure. The decision is ultimately a business one, which is why it should be framed in advance with your board, lawyers and insurer.

How long does it take to recover from a ransomware attack?

Incident-response firms such as Coveware have reported average downtime of around three weeks, and full recovery of every system can take months. Large companies like Jaguar Land Rover needed about five weeks to restart production. Companies with tested offline backups and a rehearsed plan recover much faster.

Does cyber insurance cover ransomware?

Many cyber policies cover incident response, data restoration, extortion payments and business interruption, but terms vary widely. Insurers increasingly require controls such as multi-factor authentication and offline backups as a condition of cover. Review the exclusions and waiting periods with your broker before you need to claim.

Start before you need it

Every company in our group has a fire plan, and nobody considers it paranoid. A cyberattack plan is the same discipline applied to the systems that now run everything else, and it costs a fraction of one week of downtime. If you want to see how we build businesses designed to last for generations, explore the Manzanos Enterprises group.