How do you report a ransomware attack?

Report internally to your security and legal teams first, then to the appropriate authorities — in the United States, CISA and the FBI (including IC3) — and notify your cyber insurer, since policies often require prompt reporting. Regulated organizations may also face mandatory disclosure obligations.

Accurate reporting depends on evidence: what was compromised, when, and from which recovery point you can safely restore. Elastio produces timestamped attestations and a full audit trail mapped to frameworks such as NYDFS, DORA, and SEC disclosure, giving regulators and insurers verifiable records of recovery point integrity.