What Should an Australian Business Do in the First 24 Hours After a Ransomware Attack?

First 30 Minutes: Contain the Ransomware Attack

Your first priority is to stop the attack from spreading to other devices and systems.

If you suspect ransomware, take these steps:

• Disconnect affected devices:

  Isolate infected computers from Wi-Fi, Ethernet and shared networks where possible.

• Protect connected systems:

  Ask your IT team to isolate potentially affected servers, network storage and other devices.

• Record the warning:

  Photograph ransom messages, unusual file extensions and error notifications.

• Avoid deleting evidence:

  Don’t reinstall operating systems or remove suspicious files before consulting your incident response team.

• Get technical assistance:

  Contact your IT provider or a cyber security incident response specialist immediately.

The Australian Cyber Security Centre (ACSC) advises recording important details and turning off infected devices to limit further harm. For business networks, coordinate shutdowns and isolation with incident responders where possible.

First 1–3 Hours: Activate Your Incident Response Plan

Once immediate containment measures are underway, activate your incident response plan.

This plan should identify who manages the incident, who makes operational decisions and how employees will communicate if normal systems are unavailable.

Assign responsibilities for:

• Investigating the affected systems and accounts
• Contacting management, insurers and relevant advisers
• Preserving logs and other technical evidence
• Assessing which business operations are disrupted
• Recording decisions and actions taken

If you don’t have a documented plan, appoint an incident coordinator and maintain a written timeline.

Businesses using external cyber security companies should involve their provider early. Specialist assistance can help determine how attackers entered the network and whether they still have access.

First 3–6 Hours: Secure Accounts and Investigate the Damage

Ransomware may involve more than encrypted files. Attackers can also steal information, compromise administrator accounts or access cloud services.

Your IT team should investigate which systems are affected and whether data may have been accessed or transferred.

Important actions include:

• Resetting compromised passwords from a clean device
• Reviewing administrator and remote-access accounts
• Revoking suspicious sessions and access tokens
• Checking email, cloud storage and backup environments
• Preserving relevant security logs

Avoid reconnecting affected devices simply to check whether they work.

Understanding the full cyber security risk helps determine which systems can be recovered safely and which require further investigation.

First 6–12 Hours: Report the Incident and Review Legal Obligations

Australian businesses can report cyber incidents through the ACSC’s ReportCyber service. Depending on the circumstances, you may also need to contact your insurer, bank, customers or relevant regulators.

If personal information has been compromised, consider whether the incident falls under Australia’s Notifiable Data Breaches scheme.

Organisations covered by the scheme must assess suspected eligible breaches promptly and take reasonable steps to complete the assessment within 30 calendar days. Once an eligible breach is established, notification obligations apply without unnecessary delay.

Certain businesses also have mandatory reporting obligations for ransomware payments.

Seek appropriate legal advice about your organisation’s reporting requirements rather than assuming every incident follows the same rules.

First 12–24 Hours: Prepare for Safe Recovery

Restoring business operations is important, but recovery should begin only when the affected environment has been assessed.

Your technical team should:

• Check whether backups are available and unaffected.
• Investigate and address the attacker’s entry point.
• Confirm which systems can be rebuilt safely.
• Prioritise critical business applications.
• Test restored systems before reconnecting them.

Never assume a backup is clean without checking it.

The ACSC advises against paying ransom demands because payment doesn’t guarantee that files will be recovered or stolen information deleted.

How Can Australian Businesses Reduce Future Ransomware Risks?

After the immediate incident, review the weaknesses that allowed the attack to occur.

Practical cyber security solutions include multi-factor authentication, security updates, endpoint monitoring, restricted administrator access and tested offline or isolated backups.

For organisations reviewing cyber security for small business, the ACSC’s Essential Eight provides a useful starting point for strengthening protection.

A broader cyber security Australia strategy should also include employee awareness, regular security assessments and a tested incident response process.

Strengthen Your Business Cyber Security with MSP Corporation

Recovering from ransomware involves more than restoring files. Businesses also need to address compromised accounts, security weaknesses and the risk of another incident.

At MSP Corporation, we provide managed IT security, network monitoring, backup and disaster recovery, and IT risk management services for Australian businesses. Our team can help you review your existing systems and discuss measures to strengthen your security arrangements.

Call 1300 554 404 or visit MSP Corporation to discuss your business’s cyber security requirements.

Frequently Asked Questions