CYBER SECURITY
Cyber Incident Response
Hit by ransomware, a hacked email account or a data breach? Our team contains the damage fast, works out exactly what happened and gets your business back on its feet. We support businesses across Australia.
Think you've been hacked? Do this first
The first hour matters. These six steps limit the damage and protect the evidence needed to investigate.
1
Disconnect affected devices
Unplug the network cable or switch off Wi-Fi on affected computers. Don't wipe, reinstall or delete anything, as that can destroy evidence.
2
Call us straight away
Ring (02) 6061 4222 so we can start containing it before it spreads. The sooner we're involved, the more we can contain.
3
Secure your accounts
From a clean device, change passwords on any affected accounts and turn on multi-factor authentication.
4
Keep a record
Take photos or screenshots of ransom notes and odd messages. Write down times, what you saw and who was affected.
5
Report it
Report the incident to ASD's ReportCyber at cyber.gov.au. If personal information is involved, you may also have notification duties.
6
Hold off on the attacker
Don't reply to the attacker or pay a ransom before getting advice. Paying doesn't guarantee you'll get your data back.
How our cyber incident response works
We respond rapidly to any suspected breach, including malware, unauthorised access, unauthorised payments, and data loss or theft. As an extension of your IT team, we handle every stage of the response so you can focus on running your business.
Our approach follows the four stages below, finishing with a clear report and a plan to stop it happening again.
01
Containment
We quickly isolate the affected devices or network segment to limit the damage and stop the attack spreading.
02
Monitoring and recovery
We work with our partners to help you regain control and visibility of your network, and we validate restored systems to make sure they're clean.
03
Attack investigation
We gather logs, errors and intrusion detection data to work out the cause, the impact and how to prevent a repeat.
04
Reporting
You get a clear report for management and technical teams: what happened, a step-by-step timeline and the lessons learned.
Every incident ends with a customised remediation action plan to strengthen your security and help prevent future breaches.
Threats we respond to
From everyday scams to targeted attacks, we help Australian businesses deal with the full range.
Destructive attacks
Malware, phishing, denial of service attacks and insider threats.
Data breaches
Exposure of customer data, personally identifiable information and other sensitive information.
Financial attacks
Extortion, ransomware, payment card theft and business email compromise.
IP theft
Theft of intellectual property, trade secrets and other sensitive business data.
Know your obligations after a cyber incident
A cyber incident can trigger reporting duties under Australian law. We help you work out what applies to you, and when.
Notifiable Data Breaches scheme
If personal information is involved, organisations covered by the Privacy Act must assess a suspected eligible data breach within 30 days. If it's likely to cause serious harm, you must notify the OAIC and the people affected as soon as practicable.
Read the OAIC guidanceRansomware payment reporting
Since 30 May 2025, businesses with an annual turnover above $3 million, and operators of critical infrastructure, must report a ransomware or cyber extortion payment to the Australian Signals Directorate within 72 hours.
Report to ASDGeneral information only, not legal advice. Speak to a legal adviser about your specific obligations.
The threat is real, and it's growing
Figures from the Australian Signals Directorate's latest published Annual Cyber Threat Report, covering the 2024–25 financial year.
84,700
cybercrime reports made to ASD's ACSC, one every six minutes
1,200+
cyber security incidents ASD responded to, up 11% on the year before
$56,600
average self-reported cost of cybercrime per report for a small business, up 14%
39%
of the ransomware incidents ASD responded to were found because ASD warned the victim first
Source: ASD's ACSC Annual Cyber Threat Report 2024–25, published October 2025. Figures are self-reported and don't capture all cybercrime.
Read the ASD reportFree resources from the experts
Official guidance you can use right now.
Report a cyber incident
Report cybercrime and cyber security incidents to the Australian Government through ASD's ReportCyber.
Report nowIncident response planning guide
ASD's practitioner guidance on planning and preparing your organisation's response to a cyber incident.
Read the guideCompromised email account
Microsoft's step-by-step guide to responding when a Microsoft 365 email account has been taken over.
View the guideWant to stop the next one before it starts? See how we help prevent incidents.
Cyber incident response FAQs
What should I do first if I think my business has been hacked?
Disconnect the affected devices from the network, don't wipe or delete anything, change passwords from a clean device, and call us on (02) 6061 4222. Then report the incident to ASD through ReportCyber at cyber.gov.au.
How quickly can you respond to a cyber incident?
We treat suspected breaches as a priority. Call (02) 6061 4222 during office hours (Monday to Friday, 8:30am to 5:30pm) and we'll start working on containment as soon as we've spoken.
Do I have to report a cyber attack in Australia?
It depends on your business and what was affected. Organisations covered by the Privacy Act must notify the OAIC and affected people about eligible data breaches likely to cause serious harm, and businesses with an annual turnover above $3 million must report ransomware payments to ASD within 72 hours. Anyone can report to ReportCyber. We'll help you work out what applies.
Should I pay the ransom?
Get advice before making any decision. Paying doesn't guarantee you'll get your data back or that the attackers won't return, and it may trigger reporting duties. We'll help you understand your options, including recovering from backups.
What does an incident response report include?
A clear review of the incident for both management and technical readers: a step-by-step account of what happened, the cause and impact, the lessons learned, and a customised remediation action plan.
Can you help us prepare before an incident happens?
Yes. We assess your risks, build incident response plans tailored to your business, and align your defences with the ACSC Essential Eight, so everyone knows exactly what to do on the day.
Been hit by a cyber incident?
Call our team on (02) 6061 4222, or send us a message and we'll be in touch.