TL;DR: What you do in the first hour of a cyber incident can have a major impact on what happens next. This checklist explains how to isolate affected systems, contact the right people, preserve useful information and meet Australian reporting obligations. The correct response can vary by incident, so contact your IT or incident-response provider as early as possible.
A cyber incident is stressful, and it is easy to make a costly mistake.
These steps are designed for non-technical staff. Follow them while contacting your IT or incident-response provider for incident-specific instructions:
Do not panic
Threat actors count on an erratic and adrenaline-fueled response. Stay calm and follow these steps:
What to do, step by step
If you see a ransom message on a screen, stay calm and work through these steps in order. Speed matters, but so does not making things worse.
- Disconnect the affected device. Unplug the network cable and switch off Wi-Fi where it is safe to do so. Do the same for any other device that may be affected. This limits how far the problem can spread.
- Record what you can see. Note the time, the ransom message, any strange file names and which device it is on. A photo of the screen works well. Keep the ransom note, any suspicious email and any alert. Your IT team and investigators will need them.
- Call your IT or incident response provider. Use a phone number you already know, and use a phone or device you are sure is clean. Avoid email, because the mailbox may be compromised. If you have cyber insurance, contact your insurer or its nominated response service early and check what your policy requires.
- Ask whether to turn the device off. Australian Government guidance says to turn off an infected device once you have recorded the details. Your provider may sometimes want it left on to preserve evidence, so follow their instructions.
- Do not wipe, reinstall or tidy anything. Leave the affected systems exactly as they are unless your provider tells you otherwise.
- Do not pay a ransom on the spot. Make that decision with your provider, not under pressure.
- If money has been transferred, call your bank straight away. Ask whether the payment can be recalled or frozen.
- Secure your accounts, with your provider’s guidance. This usually means resetting passwords from a trusted device, signing out anyone still logged in, and strengthening the extra sign in check (MFA) on your accounts.
- Report the incident where appropriate. Reporting can support your recovery and, in some circumstances, is a legal requirement.
Where to report a cyberattack
- In Australia report through ASD (Australian Signals Directorate), or call their hotline on 1300 CYBER1 (1300 292 371).
- India contact CERT-In
- Singapore Cyber Aid
- New Zealand NCSC
- US: the FBI’s IC3 and CISA.
- UK: the NCSC and Action Fraud.
Inform your cyber insurer regardless of location.
If money was wired to a scammer, speed matters more than anywhere else. According to the FBI’s 2023 Internet Crime Report, its Recovery Asset Team achieved a 71 percent success rate freezing funds on cases reported quickly enough, holding onto USD 538 million across 3,008 incidents. Reporting late gives fraudsters time to move the money beyond reach.
Certain Australian organisations have mandatory ransomware and cyber-extortion payment reporting obligations under the Cyber Security Act 2024. This includes entities carrying on business in Australia with annual turnover in the previous financial year of at least $3 million, as well as certain responsible entities for critical infrastructure assets. A report must generally be made within 72 hours of making, or becoming aware of, the payment. Check the current Australian Government guidance and seek legal advice where necessary. Cyber Security Act 2024
In Australia, organisations covered by the Privacy Act may also have obligations under the Notifiable Data Breaches scheme. If an eligible data breach is suspected, the OAIC expects to be notified as soon as is practicable. Requirements differ across states and countries, so involve your legal adviser and incident-response provider early.
Should you pay the ransom?
Australian Government guidance is not to pay a ransom. Payment does not guarantee access will be restored and may expose the organisation to further risk.
Do not make decisions about an extortion demand alone or in a panic. Engage your incident-response provider, cyber insurer, legal adviser and, where appropriate, law enforcement. Your response team can also investigate whether a reputable decryption tool exists for the ransomware variant involved.
The best time to prepare is before it happens
All of this is easier if it is decided in advance. You don’t need a thick binder. A single page covering three things does most of the work:
- Who to call first, your IT provider and your insurer, with numbers kept somewhere you can reach even if your main systems are compromised.
- Where your backups sit, with proof they’ve been tested by restoring from them.
- Which accounts and devices matter most, so you can assess your priorities.
Many small businesses can document this core information in a short incident-response plan. The plan should be reviewed and practiced so people know what to do when normal systems are unavailable.
Frequently asked questions
What is the first thing to do in a cyberattack? Isolate the affected device from the network where safe to do so, then call your IT or incident-response provider using a known phone number. If the incident appears to be ransomware, record key details and follow current Australian Government guidance and your provider’s instructions about powering down the device.
Should I turn off the computer if I get ransomware? Australian Government ransomware guidance recommends recording key details and turning off the infected device. Contact your IT or incident-response provider immediately, as incident-specific forensic considerations may affect the instructions you receive.
We transferred money to a scammer. What do we do? Call your bank immediately and ask whether the transfer can be recalled or frozen. In Australia, report the incident through ReportCyber and follow any advice from your bank, insurer, legal adviser and incident-response provider.
A calm, planned and practiced response is so much better than a fast, panicked one.
Get in touch if you’d like a hand building your Disaster Recovery plan, before you ever need it.