Imagine a company with 150 employees. It operates a website, stores customer records in a database, uses a shared file server and relies on email and accounting software.

One Monday morning, employees find that they cannot open their files. A message appears demanding payment to restore access. The company suspects ransomware.

What happened before Monday?

Day −14 Stage 1 - Initial access

An employee receives a convincing email and enters their password on a fraudulent sign-in page. Alternatively, the attackers obtain credentials that were stolen in an earlier breach.
Possible evidence: email headers, sign-in records, suspicious IP addresses and reports of unusual messages.

Day −13 Stage 2 - An account is compromised

The attacker signs in using the stolen credentials. If the account has broad permissions or lacks multi-factor authentication, the attacker may gain access to email, shared files or remote-access services.
Possible evidence: a login at an unusual time, an unfamiliar device or unexpected access to sensitive records.

Days −12 to −7 Stage 3 - The attacker explores

The attacker attempts to discover other systems, obtain more powerful permissions and locate valuable data. They may also look for backups and ways to disable security monitoring.
Possible evidence: unusual administrative activity, new accounts, unexpected software and attempts to access multiple computers.

Days −6 to −1 Stage 4 - Data theft and preparation

Some ransomware groups copy sensitive information before encrypting files. They may try to weaken backups or prepare to affect multiple systems at once.
Possible evidence: unusual outbound data transfers, unexpected archive files, abnormal backup activity or security alerts.

Day 0 Stage 5 - Ransomware becomes visible

Employees discover inaccessible files and a ransom note. The company now has clear evidence of a major incident, but the attacker may already have stolen information or compromised other systems.
Possible evidence: ransom notes, renamed or encrypted files, endpoint security alerts and failed access to shared systems.

This timeline is illustrative, not a claim that every ransomware attack follows this exact sequence. Some attackers move much faster; others never steal data or spend much time inside a network. The NCSC and CISA describe these patterns in their ransomware guidance

Source: National Cyber Security Centre

The attack on Change Healthcare demonstrates how a weakness at the beginning can have consequences far beyond the affected computer.

The entry point

UnitedHealth's chief executive told a US congressional committee that the attackers used compromised credentials to access a remote-access portal that did not have multi-factor authentication enabled.
House Committee on Energy and Commerce

The consequences

The ransomware attack disrupted healthcare claims and payment processing across the United States, affecting providers and pharmacies that depended on the service.
Reuters

The key lesson is not simply that the organisation lacked a security feature. It is that an access-control weakness at a critical entry point can expose services on which many other organisations depend.

Once the incident is contained, investigators build a timeline by comparing evidence from different sources.

No single log usually tells the whole story. A login from an unfamiliar location is a warning sign, not proof of criminal activity. Investigators corroborate it with other evidence.

The first priority is to stop further damage, not to start deleting files or immediately rebuilding computers.

1. Contain the incident. Isolate affected devices and, where necessary, disconnect affected network segments to limit spread.
2. Bring in incident-response specialists. Preserve relevant logs and evidence, and identify the systems and accounts involved.
3. Secure accounts and access. Reset compromised credentials and address the original entry point, taking care not to disrupt evidence collection or recovery.
4. Assess data theft. Determine what information may have been accessed or copied, and obtain appropriate legal and regulatory advice.
5. Restore safely. Rebuild affected systems and restore from backups only after checking that they are clean.
6. Report the incident. Follow applicable UK reporting obligations and contact the appropriate authorities.

The NCSC provides a detailed ransomware response guide. It also advises that paying a ransom does not guarantee recovery or prevent stolen information from being disclosed.