Hit by Ransomware or a Cyber Attack? What to Do in the First Hour
A practical, step-by-step guide for Australian businesses dealing with ransomware, a hacked email account or a data breach: what to do immediately, who to report it to, and the mistakes that make recovery harder.
Brandon Strangman7 min read
If you are reading this because something is happening right now, call us on (07) 3521 8515 (Monday to Friday, 8:30am to 4:30pm). Outside those hours, the Australian Cyber Security Centre hotline on 1300 CYBER1 (1300 292 371) operates around the clock. Then come back to this page.
The first hour after you discover a cyber incident shapes everything that follows: how much data you lose, how long you are offline, and whether you can work out what happened. Here is what to do, in order.
Step one: contain it without destroying the evidence
1 Disconnect affected machines from the network
Unplug the network cable and turn off Wi-Fi on any computer showing ransom notes, encrypted files or unusual behaviour. If you have many affected devices, disconnecting the office internet connection can buy time.
2 Do not turn machines off unless told to
It is tempting to power everything down. But memory holds evidence that disappears when a machine is switched off, and some ransomware does more damage during an interrupted shutdown or restart. Disconnect first, then get advice.
3 Protect your backups
If you have a backup drive or NAS connected to the network, disconnect it now. Ransomware actively looks for backups to encrypt or delete. Cloud backups with separate credentials are usually safer, but do not log in to them from an infected machine.
4 Change passwords from a clean device
If an email or Microsoft 365 account is compromised, reset the password and sign out all sessions from a device you know is clean, such as a phone on mobile data. Make sure multi-factor authentication is on for that account and check that the attacker has not added their own MFA method.
Attackers who get into an email account commonly set up hidden inbox rules that forward or delete messages. Resetting the password alone does not remove them.
Step two: work out what you are dealing with
Different incidents need different responses. Try to establish which of these you have:
- Ransomware: files renamed or unreadable, a ransom note on screen or in folders
- Email account compromise: colleagues or clients receiving emails you did not send, unexplained inbox rules, password reset emails you did not request
- Payment redirection: a supplier or client says they paid an invoice to new bank details you never sent
- Data breach: evidence that someone has accessed or copied customer, patient or staff information
Write down what you have seen, when you first noticed it and what has been done so far. Take photos of ransom notes and error messages. This timeline is valuable to your IT provider, your insurer and the authorities.
Step three: make the right calls
1 Your IT provider or an incident response specialist
Get experienced help before trying to clean or restore anything. Restoring from backup onto machines that are still compromised is one of the most common ways businesses get hit twice.
2 Your cyber insurer
If you have cyber insurance, call the insurer's incident line early. Many policies require prompt notification and have preferred responders, and acting without them can affect your claim.
3 Your bank
If money has been sent to a fraudulent account, call your bank immediately and ask them to attempt a recall. Speed matters: the sooner the receiving bank is contacted, the better the chance of recovering funds.
4 Report it to the ACSC
Report the incident through ReportCyber at cyber.gov.au. Reporting helps the ACSC warn other businesses and can connect you with further assistance.
Step four: understand your legal obligations
The Notifiable Data Breaches scheme. If your business is covered by the Privacy Act and personal information has been accessed or disclosed in a way likely to cause serious harm, you must notify the Office of the Australian Information Commissioner and the affected individuals. You have up to 30 days to assess a suspected breach, but you should act as quickly as possible. Most businesses with annual turnover under $3 million are exempt from the Privacy Act, but health service providers and several other categories are covered regardless of size.
Ransomware payment reporting. Under the Cyber Security Act 2024, businesses with annual turnover above $3 million that make a ransomware payment, or have one made on their behalf, must report it to the Australian Signals Directorate within 72 hours.
Should you pay? The ACSC advises against paying ransoms. Payment does not guarantee you will get your data back, does not stop the attacker publishing stolen data, and marks your business as willing to pay.
The mistakes that make things worse
- Wiping machines before anyone has investigated. You lose the ability to find out how the attacker got in, so they can come back the same way.
- Using the compromised email account to discuss the incident. Attackers read those messages.
- Restoring backups without checking them. Make sure the backup predates the compromise and is clean.
- Assuming it is over once systems are back up. Attackers often keep a second way in. Check for new admin accounts, remote access tools and changed firewall rules.
After the incident
Once you are operating again, the priority is making sure it cannot happen the same way twice. That usually means multi-factor authentication everywhere, tested offline or immutable backups, patched systems, restricted admin rights and staff who know how to spot phishing. These are the foundations of the Essential Eight.
Write a one-page incident plan now, while nothing is wrong. List who to call, where your backups are, who can authorise payments and how to reach your insurer. In a real incident, nobody thinks clearly.
Get help now
Defy IT helps Brisbane, Ipswich and Gold Coast businesses contain incidents, recover systems and close the gaps that let attackers in. If something is happening now, call (07) 3521 8515. If you want to make sure it never does, see our cyber security services or tell us what's going on.
Quick Reference Summary
Written byBrandon StrangmanNeed Help with Your Business IT?
Ready to implement these strategies? Our expert team at Defy IT can help you build a resilient, secure IT environment tailored to your specific business needs.
Contact Us TodayReading up on cybersecurity? Explore our Cyber Security services or see how we help law firms and medical practices.