# Ransomware Response Plan for Saudi Organizations: The First 72 Hours

By Aburahman Adimi 18 October 2026 7 min read

On this page

1. What is double-extortion ransomware, and why does it matter fior Saudi organizations?
2. What should you do in the fiirst hour ofi a ransomware attack?
3. Who do you need to notifiy in Saudi Arabia, and how fiast?
4. What happens between hour 1 and hour 72?
5. Should you pay the ransom?
6. How can you prepare befiore a ransomware attack happens?
7. FAQ
8. Find your gaps befiore attackers do

If ransomware hits your organization in Saudi Arabia, you have about 72 hours to contain it, recover critical systems and meet your notification duties. Under the PDPL Implementing Regulations, a personal data breach must be reported to SDAIA within 72 hours of becoming aware of it. Entities in the NCA’s scope must also report incidents to the Authority. This guide sets out what to do in the first hour, the first day and the first three days, and what to put in place now so that day never comes.

The threat is close to home. In early October, the ransomware group WallStreet claimed it stole more than 1.5 million files, about 17 TB, from China Railway Construction Corporation, part of the consortium building Jeddah Central Stadium for the 2034 FIFA World Cup. The claimed data includes contracts, stadium designs and personal data on about 150,000 employees, [according to The National](https://www.thenationalnews.com/future/technology/2026/10/06/hackers-saudi-arabia-cyberattack-world-cup/). The company had not commented at the time of reporting.

## What is double-extortion ransomware, and why does it matter fior Saudi organizations?

Classic ransomware encrypts your files and demands payment for the key. Double extortion adds a second threat: the attackers copy your data first, then threaten to publish it if you don’t pay. SOCRadar’s profile of WallStreet says the group uses exactly this approach.

That changes how you respond. Restoring from backups solves the encryption problem, but it does nothing about the stolen data. A double-extortion attack is a data breach as well as an outage, so legal, privacy and communications teams need to be in the room from the first hour, not just IT.

Attackers are also getting faster. Microsoft’s 2026 Digital Defense Report found that the median time from a vulnerability being discovered to being weaponized is now under 24 hours. Phishing was the entry point in 23% of the intrusions Microsoft’s responders investigated, up from 7% a year earlier, and exploits against public-facing applications rose from 15% to 24%, [as summarized by Help Net Security](https://www.helpnetsecurity.com/2026/10/02/ai-cybersecurity-threats-microsoft-report/). Patching quarterly and training staff once a year no longer matches that pace.

## What should you do in the fiirst hour ofi a ransomware attack?

The first hour decides how far the damage spreads. Work through these steps in order:

1. **Isolate, don’t power off.**Disconnect affected machines from the network (unplug the cable, disable Wi-Fi) but leave them running. Memory holds evidence that disappears on shutdown.
2. **Activate your incident response team.**Call the people named in your plan: IT or SOC lead, CISO, legal, data protection officer, communications and an executive sponsor. If you have a retainer with an incident response provider, call them now.
3. **P****ro****tect y****our****back****u****ps.**Take backup systems offline or confirm they are immutable. Attackers often hunt for backups before they encrypt anything else.
4. **L****oc****k d****ow****n p****r****ivileged access.**Reset domain admin and service account passwords from a clean device, and revoke active sessions for suspicious accounts. Microsoft found that in 52% of intrusions that started with valid accounts, attackers went on to harvest more credentials.
5. **Sta****r****t a timeline.**Write down what was seen, when and by whom. You will need it for regulators, insurers and your own lessons learned.
6. **D****o****n’t c****o****ntact the attacke****r****s yet.**Any negotiation decision belongs to leadership, with legal advice, after the facts are clearer.

## Who do you need to notifiy in Saudi Arabia, and how fiast?

Notification is where many organizations stumble, because several authorities can be involved at once. The table below covers the main ones. Confirm your own obligations with legal counsel, as they depend on your sector and status.

| Who | When it applies | Deadline | How |
| --- | --- | --- | --- |
| SDAIA (PDPL regulator) | Personal data was accessed or stolen and the breach may harm data subjects | Within 72 hours of becoming aware | SDAIA’s breach notification channel |
| Affected individuals | Same breach, where it may harm their rights or interests | Without undue delay | Direct notice from the controller |
| National Cybersecurity Authority (NCA) | Incidents affecting national entities | As soon as possible | Phone 936 or isnca.gov.sa, per the NCA’s incident page |
| Sector regulator (for example SAMA for financial institutions) | Regulated entities in that sector | Per that regulator‘s rules | The regulator‘s own reporting process |
| Clients and partners | Contracts that require incident notice | Per contract terms | Account managers, with legal sign-off |

The 72-hour PDPL clock starts when you become aware of the breach, not when the investigation ends. You can file what you know and update later. Waiting for a complete picture is the most common way to miss the deadline.

## What happens between hour 1 and hour 72?

Once the spread is contained, the work splits into three tracks that run in parallel.

**Investigate.**Find the entry point: a phishing email, an exposed VPN, an unpatched public-facing app, or a supplier‘s account. Establish what data left the network and when.

Without this, you can’t scope notifications or be sure the attackers are gone.

**Rec****o****ve****r****.**Restore critical systems first, from backups you have verified as clean. Rebuild rather than clean compromised servers where you can. Bring systems back in stages and monitor each one closely, because attackers often leave a second way in.

**C****o****mm****u****nicate.**Prepare one approved statement for staff, customers and partners. Tell employees not to discuss the incident on social media or with anyone claiming to be from the press or the attackers. Keep regulators updated as the facts develop.

## Should you pay the ransom?

There is no guarantee that paying returns your data or keeps it private. With double extortion, you are paying criminals to delete copies you can’t verify. Payment can also fund further attacks, and it may raise legal and sanctions questions. Make this decision at board level, with legal counsel, and only after you know whether your backups can restore operations without it. The best position is never needing to ask.

## How can you prepare befiore a ransomware attack happens?

- Most of the response above depends on work done in advance. Use this checklist to test your readiness:
- A written incident response plan, with named owners and out-of-hours contacts
- Offline or immutable backups, with a restore tested in the last quarter
- Multi-factor authentication on email, VPN, remote access and all admin accounts
- Patching for internet-facing systems measured in days, not months
- 24/7 monitoring of endpoints and identity, in-house or through a managed SOC
- Phishing awareness training that runs all year, with simulations
- A recent penetration test of external systems and the paths to your domain controllers
- Cybersecurity requirements in supplier contracts, including incident notice deadlines
- A pre-agreed notification workflow for SDAIA, the NCA and your sector regulator
- A tabletop exercise in the last 12 months, run with leadership

The supplier line deserves attention. The Jeddah stadium case shows how one contractor can expose a whole project. ECC-2:2024 treats third-party and cloud cybersecurity as one of its four main components, so supplier controls are a compliance issue as well as a risk issue.

## FAQ

**H****ow****l****o****ng d****o****I have t****o** **r****ep****or****t a pe****r****s****o****nal data b****r****each in Sa****u****di A****r****abia?**Under the PDPL Implementing Regulations, controllers must notify SDAIA within 72 hours of becoming aware of a breach that may harm data subjects. Affected individuals must be told without undue delay.

**D****o****I need t****o** **r****ep****or****t****r****ans****o****mwa****r****e t****o****the NCA?**The NCA asks national entities to report cybersecurity incidents through its incident line (936) or isnca.gov.sa. Check your status under ECC-2:2024 and any sector rules with your compliance team.

**Can back****u****ps al****o****ne p****ro****tect****u****s f****ro****m****r****ans****o****mwa****r****e?**Backups protect against encryption, not data theft. With double extortion, attackers can still threaten to leak stolen data, so you also need monitoring, access controls and a breach response plan.

**What is the m****o****st c****o****mm****o****n way****r****ans****o****mwa****r****e gets in?**Phishing, exposed remote access and unpatched public-facing applications. Microsoft’s 2026 report found phishing behind 23% of the intrusions it investigated.

**Is a managed SOC w****or****th it f****or****a mid-sized****or****ganizati****o****n?**If you can’t staff 24/7 monitoring in-house, yes. Attackers often strike at night or on weekends, and a managed SOC shortens the time between first sign and containment.

## Find your gaps befiore attackers do

CYBRT’s free maturity assessment, built on NCA and NIST frameworks, scores your readiness in 20 questions, including incident response, backups and third-party risk. [Start](https://cybrt.sa/maturity/) [the assessment](https://cybrt.sa/maturity/). If you need help now, talk to our 24/7 managed CSOC team.

How CYBRT can help

## Managed CSOC

Advanced attacks often go undetected for more than 200 days, and without a practised response plan containment drags on. Our managed CSOC combines skilled analysts, advanced tooling and real-time threat intelligence for continuous monitoring, detection and response.

## Keep reading

Resilience 6 May 2026 4 min read

### How to Choose a Managed SOC Provider in Saudi Arabia

The questions to ask a managed SOC provider about visibility, detection, response, data residency, people and reporting, plus the red flags to watch for.

Governance 30 Sept 2026 4 min read

### What Does a Virtual CISO Do? A Guide for Saudi Organisations

What a virtual CISO delivers, who benefits, how it fits NCA and SAMA expectations for an in-house security lead, and what a good first 90 days looks like.

Threats 16 Sept 2026 3 min read

### Oh, I use MFA!

Passkeys were supposed to end phishing. How device code phishing gets past MFA, and the identity controls that stop it.

## Ready to protect your business?

Book your free security consultation today.

---

Canonical page: https://cybrt.sa/ransomware-readiness-response-plan/
Guide for AI agents: https://cybrt.sa/llms.txt