What to do in the first hour after a ransomware attack

Ransomware is malicious software that locks or encrypts your files and demands payment to unlock them. Many attackers also copy data first and threaten to publish it. If you see a ransom note, files with strange new extensions, or staff reporting that nothing will open, treat it as an emergency and work through this list in order. Print it and keep a copy somewhere other than your computer.

Minutes 0 to 5: record what you see

The Australian Signals Directorate (ASD) puts this first. Before anything else, record the important details:

• Take a photo of the screen with your phone, including the ransom note.
• Note any new file extension added to your files.
• Write down the time you noticed, which device it was on and who was using it.

This takes a minute and helps your IT provider, ASD and your insurer later.

Minutes 5 to 10: stop the spread

ASD says acting quickly could stop the ransomware spreading. Its steps are:

1. Turn off the infected device. Hold down the power button or unplug it from the wall.
2. Turn off your other devices on the network, starting with the most important ones, such as the computer that runs your accounts or practice software.

If your IT provider is already on the phone and gives you different instructions for a particular machine, follow their direction. They may be able to see what is happening across your network.

Minutes 10 to 15: call your IT provider

Call, don't email. Your email may be affected, and a phone call gets a faster answer. Tell them what you recorded and what you have turned off. ASD recommends getting professional help to work through a ransomware attack. This is where written response times matter: on our Total Fortress plan there is a 15-minute 24/7 critical line for exactly this situation.

Do not pay the ransom

The Australian Government strongly discourages paying ransoms. ASD warns there is no guarantee you will regain access to your information, nor prevent it from being sold or leaked online.

If a payment is made anyway, a reporting rule may apply. Under the Cyber Security Act 2024, businesses with an annual turnover of $3 million or more must report a ransomware or cyber extortion payment to ASD within 72 hours of making it, or of finding out it was made on their behalf. This obligation has applied since 30 May 2025.

Do not wipe anything yet

It is tempting to wipe the affected computers and start again. ASD advises doing that last, only after you have recorded the details and recovered what you can, because wiping permanently deletes data. That data may include evidence of how the attackers got in.

Be careful with backups too. ASD advises against accessing backups you suspect are affected, and says to restore only from backups that were never connected to the infected device or network. Let your IT provider check backups before anyone touches them.

Minutes 15 to 30: change important passwords

Using a device you know is clean, such as a phone that was not connected to the business network, change the passwords for your most important accounts. ASD lists email, bank, cloud storage and business accounts. Turn on multi-factor authentication anywhere it is not already on.

Minutes 30 to 45: report it

• Report to ASD through ReportCyber at cyber.gov.au.
• Call the 24/7 Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371) if you need cyber security help. Only use the number from cyber.gov.au or this page. Never call a number given in the ransom note.

Minutes 45 to 60: tell the people who need to know

• Your cyber insurer. ASD notes that some reports may be urgent, such as those required by insurance obligations. Many policies set out who you must call and what you must not do before the insurer is involved, so read yours before you ever need it.
• Your bank, straight away if any money has been lost. Use the official phone number.
• Staff, with a short instruction: don't turn devices back on, don't plug in USB drives, and don't post about it.
• IDCARE, if personal information is at risk. ASD also lists the ATO if your personal or business identity was stolen.

Start your data breach assessment

If the attackers may have accessed or copied personal information, such as patient, client, child or staff records, the Notifiable Data Breaches (NDB) scheme may apply. It covers businesses and not-for-profits with annual turnover above $3 million, plus some smaller ones, including health service providers and businesses that trade in personal information.

The OAIC's guidance says that if you have reasonable grounds to suspect an eligible data breach, you must carry out a reasonable and expeditious assessment and take all reasonable steps to finish it within 30 calendar days. If you then have reasonable grounds to believe it is an eligible breach, you must notify affected individuals and the OAIC as soon as practicable. Start a written log in the first hour: what happened, when, what systems hold personal information, and every decision you make.

This is a plain-English summary. Check with the OAIC or your legal adviser about your specific obligations.

First-hour checklist

1. Photograph the screen and ransom note. Note the time, device and file extension.
2. Turn off the infected device, then other devices, most important first.
3. Phone your IT provider.
4. Do not pay. If a payment is made and turnover is $3 million or more, report it to ASD within 72 hours.
5. Do not wipe devices or touch backups until they are checked.
6. Change important passwords from a clean device and turn on MFA.
7. Report through ReportCyber. Call 1300 CYBER1 for help.
8. Notify your insurer and, if money is lost, your bank.
9. Start a breach log and the 30-day NDB assessment if personal information is involved.