The files are encrypted: the first forty-eight hours, in order

Nine in the morning. Somebody opens a file and it will not open. Its name now ends in an extension nobody recognises. They try a second file, then a third. And in the shared folder sits a text file that was not there yesterday.

What happens in the next hour decides a great deal of what happens in the next month. Here is the order of the steps, including the ones Egyptian law requires and gives you a deadline in hours to complete.

The first five minutes: disconnect, do not power off

Disconnect the network. Pull the cable from the affected machines and take them off the wireless. If it has spread widely, disconnect the core switch or shut its ports. Your only goal in these minutes is to deny access to whatever is not hit yet.

Do not switch the machine off. This is counter-intuitive and it matters. The memory of a running machine may hold encryption keys and traces of the process itself, and all of it is lost on shutdown. Only if you have no way at all to take the machine off the network should you power it down.

Disconnect the backup before anything else. If it is an external disk, unplug it. If it is a network share, cut it. Modern ransomware hunts the backup first, and losing it turns the incident from a hard day into a catastrophe.

Three mistakes that cost the data itself

Rebooting, repeatedly. Some families resume encrypting at every boot. Each restart can mean more files.

Downloading a decryptor from a search result. Plenty of pages promise decryption and deliver a second piece of malware. If you look for a tool, look in the No More Ransom project, a joint initiative of European law enforcement and security vendors. Its Crypto Sheriff takes an encrypted file and the ransom note and tries to identify the family for you, so you do not have to know it before you start.

Writing over the evidence. Do not reinstall on the affected machine on day one. If you need to get someone working quickly, put them on a different machine and leave this one as it is.

A clock that starts the moment you know: seventy-two hours

This is the point that catches most Egyptian companies out. If what was encrypted holds personal data — staff, customers, patients, students — you are facing an obligation with a legal deadline.

Personal Data Protection Law No. 151 of 2020 requires the controller and the processor to notify the Centre within seventy-two hours of becoming aware of the infringement rather than of its happening, and then to notify the data subject within three working days of notifying the Centre. The regulations name the route too: the Centre's electronic portal or its hotline.

And the part many have not caught up with: the law's Executive Regulations were issued by decree of the Minister of Communications and Information Technology, No. 816 of 2025, on 1 November 2025, carrying one year from issuance to bring positions into line — so 31 October 2026.

Do not misread that year. The law has been in force since 2020 and its penalties with it; the year is to reconcile your position, not a holiday from the law. Failing the notification duty in Article 7 specifically carries a fine of EGP 300,000 to 3 million, other breaches reach EGP 5 million, and failing to appoint a registered data protection officer starts at EGP 200,000.

So start the clock from the moment you discovered it — which is genuinely the moment the law counts from — and write that time on a piece of paper. You will need it, because the notification itself asks for the time of awareness and the time of reporting.

This section explains published deadlines; it is not legal advice. For how the law applies to your situation, and for drafting the notification itself, consult a qualified lawyer.

Who to notify in Egypt

• The Personal Data Protection Centre — if what was encrypted holds personal data, inside the deadline above.
• EG-CERT, the Egyptian Computer Emergency Readiness Team under the National Telecom Regulatory Authority, which runs an incident reporting portal. Reporting here helps you practically rather than formally: they may recognise the family and the way in.
• The public prosecution or the cybercrime department — the incident is an offence under the Anti-Cyber and Information Technology Crimes Law No. 175 of 2018. The report is also required by an insurer if you hold a policy, and by any customer or supplier who asks for proof of what happened.
• Your customers and suppliers — if their data is in scope, or if mail could plausibly reach them from your accounts.

Do you pay?

The professional answer is no, and here are the reasons without the sermon. Paying does not guarantee a key that works, does not guarantee every file returns, and does not stop a copy of your data being published afterwards. And a company that pays once becomes a target known to pay.

One situation leaves the question genuinely open: a company with no usable backup and data with no substitute. Even then the decision is not taken in a tense meeting an hour after discovery, but after legal advice and after confirming that recovery is truly impossible rather than merely difficult.

Recovery: the order that prevents the second infection

What demoralises companies most is restoring everything and then being encrypted again two days later. The order is what prevents it:

1. Find out how they got in. An exposed remote desktop port? A vulnerability on an edge device? A mail attachment? Restoring before you know the door means restoring into a network whose door is still open.
2. Close it. Patch the hole, shut the port, turn on two-factor authentication.
3. Change every password, especially administrator and service accounts. Assume all of them leaked.
4. Rebuild machines rather than cleaning them. An affected server is wiped and built again.
5. Scan the backup before you restore from it; it may be a carrier.
6. Restore into a clean environment, and watch it for a week.

Any of these steps you do not have ready today belongs in next week's plan, not in the plan you write after an incident.

Afterwards: two pages written once

Write down what happened with dates and times: when it was found, who was told, what was done, when each system came back. Two pages written during the incident save a month of argument after it, and you will need them if a regulator or a customer asks.

Then ask one question: if this happened again tomorrow, which step would be different? The answer is usually three things — a backup isolated from the network, a memory of what the logs saw, and a list of numbers for whoever finds it.

The first is covered by the backup guide, the second is what log monitoring does, and the third takes ten minutes today. On meeting Law 151 before November, see what it means for your infrastructure.

ZEMAVO Technology works on response, recovery and closing the way in afterwards — and on what prevents it beforehand. If you are in that hour right now, talk to us.