Has your business been hacked? Follow our comprehensive incident response guide to contain the breach and recover your data safely.
Discovering that your business has been compromised is one of the most stressful technology events a business owner faces. The decisions made in the first hours significantly affect how severe the ultimate impact is.
This guide gives you a clear, actionable response sequence for the most common incident types. It is designed to be used under pressure — with concrete steps, not principles.
The Most Important First Step: Do Not Panic and Do Not Touch Anything
The instinct when discovering a cyber incident is to immediately start trying to fix it — unplug things, delete suspicious files, reset passwords everywhere. This impulse, while understandable, can destroy forensic evidence and make the incident worse.
The first step is: stop, assess the situation, and call for help before taking significant action.
Call your IT provider’s emergency line. If you do not have a managed IT provider, call a cyber incident response specialist (the ACSC Hotline is 1300 CYBER1 — 1300 292 371).
Scenario 1: Ransomware Attack
Signs: Files have strange extensions, you cannot open documents, a ransom note appears on screen.
Immediate Steps (First 30 Minutes)
-
Isolate affected devices immediately. Disconnect compromised computers from the network — unplug the ethernet cable or disable Wi-Fi. Ransomware propagates across network shares; isolation limits spread.
-
Do not shut down the device. Ransomware may have encrypted files but the encryption keys may still be in memory. A forensic specialist may be able to extract them. Do not power off unless the device is actively encrypting and you cannot disconnect it from the network.
-
Identify the blast radius. Which devices are affected? Which are not? What network shares were accessible from the affected devices? What cloud services were the affected user accounts connected to?
-
Preserve the ransom note. Photograph the screen. Note the ransomware variant name if visible — this determines whether free decryption tools exist (check nomoreransom.org).
-
Do not pay the ransom yet. This is a decision requiring careful consideration with legal advice, your cyber insurer (if applicable), and an incident response specialist. Paying does not guarantee file recovery and may trigger legal issues.
Recovery Phase
-
Restore from clean, isolated backups to clean, reimaged systems. Do not restore to systems that may still be compromised.
-
Identify the initial compromise vector (phishing email, exposed RDP, unpatched vulnerability) and close it before bringing systems back online.
-
Complete a credential reset for all accounts on affected systems.
-
Notify your cyber insurer before engaging external IR specialists — most cyber insurance policies require this.
Scenario 2: Account Compromise (Email or Microsoft 365)
Signs: Colleagues receive unusual emails from your account, you receive unexpected MFA prompts, inbox rules you did not create appear, sent items you did not send.
Immediate Steps
-
Revoke active sessions. In Entra ID (for Microsoft 365): Admin Centre → Users → Select user → “Revoke sessions.” This terminates all active authenticated sessions, immediately logging the attacker out.
-
Reset the account password to something long and unique.
-
Review and remove inbox rules. Go to Outlook settings → Rules. Delete any rules you did not create — particularly rules that forward email to external addresses or move email to obscure folders.
-
Check for delegate access and forwarding. Outlook settings → Mail → Forwarding (should be off). Outlook Web → Share and delegate access (remove anything unexpected).
-
Review sent items. What emails did the attacker send? To whom? This determines whether clients or suppliers have received fraudulent messages you need to countermand.
-
Notify affected parties. If the compromised account was used to send fraudulent payment instructions, contact affected parties immediately by phone.
Enable MFA Immediately
If MFA was not enabled before the compromise, enable it now — before restoring the account to normal use. A compromised account with MFA enabled is significantly harder to re-compromise.
Scenario 3: Data Breach (Unauthorised Access to Personal Information)
Signs: Unusual access to systems containing personal data, notification from a third party that your data is being sold, discovery of unauthorised data exfiltration in logs.
Immediate Steps
-
Contain the access point. Identify how unauthorised access occurred and close it: revoke credentials, patch the vulnerability, restrict access.
-
Preserve logs. Do not restart systems or clear logs until logs have been captured and preserved for investigation.
-
Identify what data was accessed. What personal information was in the affected systems? Whose? How many individuals? This determines notification obligations.
Legal Obligations Under the Privacy Act
Australia’s Notifiable Data Breaches (NDB) scheme requires notification to the OAIC and affected individuals when a data breach:
- Involves personal information
- Is likely to result in serious harm to affected individuals
You must assess whether the breach meets this threshold. If it does, you must notify within 30 days of becoming aware (and act as soon as practicable).
Engage your legal advisers on notification obligations before communicating externally — the wording and timing of notifications has legal implications.
Notification Obligations Summary
| Scenario | Who to notify | When |
|---|---|---|
| Ransomware with data exfiltration | OAIC, affected individuals, cyber insurer, police (optional) | As soon as practicable; within 30 days if NDB threshold met |
| Account compromise with data access | OAIC (if personal data accessed), affected parties, cyber insurer | Within 30 days if NDB threshold met |
| BEC/financial fraud | Bank (immediately), police, ACSC | Immediately — banks have fraud recovery procedures that work only if notified quickly |
Engaging Your Cyber Insurer
If you have cyber insurance, notify your insurer at the earliest opportunity — before engaging external IR specialists if possible. Most cyber policies:
- Require prompt notification as a condition of coverage
- Have an approved panel of IR specialists they prefer (or require you to use)
- Cover reasonable IR costs, legal costs, and notification costs
An insurer who is not notified promptly may dispute coverage. Call them early.
Building a Pre-Incident Response Plan
The best time to read this guide is before you need it. Document your response procedures, your key contacts, and your recovery sequence while systems are running and pressure is low.
CX IT Services helps Melbourne businesses develop incident response plans and provides emergency IR support for managed clients. Book a Right Fit Call to discuss incident preparedness.
