Fast Response, Quality Service, Professional Technical Support

Remote Support

Get Help Now

1300 655 121

Get Help Now

1300 655 121

Fast Response, Quality Service, Professional Technical Support

Remote Support

Ransomware protection: practical steps for Australian businesses

If you suspect ransomware right now, stop and do these four things before anything else.

  • Isolate affected devices immediately. Disconnect them from your network, Wi-Fi, and any shared drives. Do not wait to confirm the infection.
  • Preserve evidence. Do not power off machines unless you have no choice. Logs, memory images, and running processes are forensic gold for investigators and insurers.
  • Do not pay the ransom. Microsoft warns that payment does not guarantee a working decryption key, and attackers often re-infect or sell your data regardless.
  • Start recovery from clean backups if you have tested, offline copies available.
  • Report the incident to the ACSC via Cyber. If customer or employee data is involved, you may also need to notify the Office of the Australian Information Commissioner (OAIC).

If you do not have tested backups, call a managed IT provider immediately. Recovery without them is a long road.

Key takeaways

Tested, offline backups are the single most reliable defence against ransomware: without them, every other control is a delay tactic rather than a recovery path.

Point Details
Isolate and preserve first Disconnect affected devices immediately and preserve logs before powering anything off.
Tested backups are the priority Follow the 3-2-1 rule with at least one immutable or offline copy; test restores monthly.
MFA and patching cut most entry points Enable phishing-resistant MFA on all remote access and admin accounts; treat critical patches as a 48-hour task.
Report to ACSC and OAIC Report every incident to cyber.gov.au; notify the OAIC if personal data is at risk under the NDB scheme.
Techbug provides managed protection Techbug offers ransomware-safe backups, EDR, staff training, and emergency response for Australian SMBs.

Table of Contents

What is ransomware and why does it matter for Australians?

Ransomware is malicious software that encrypts your files or systems and demands payment for the decryption key. Modern variants go further: attackers exfiltrate data before encrypting it, then threaten to publish it publicly if you do not pay. This “double extortion” model means that even a perfect restore from backups does not eliminate the threat of a data leak.

Australian individuals and small to medium businesses (SMBs) are squarely in the crosshairs. The ACSC and CISA both document ransomware as one of the most disruptive cyber threats facing organisations of every size. SMBs are particularly attractive targets because they often hold valuable data but lack the security depth of larger enterprises. 42% of cyberattacks target small businesses, which makes the risk concrete rather than theoretical.

What to do in the first 24 hours if ransomware hits

Speed and discipline in the first hours determine how bad the outcome gets. Work through this in order.

  1. Isolate affected systems. Pull the network cable or disable Wi-Fi on any machine showing signs of encryption or unusual file activity. If you manage multiple sites, alert your IT team to check all locations simultaneously.
  2. Do not power off critical systems unless forced to. Volatile memory (RAM) holds encryption keys, malware artefacts, and attacker session data. A forensic image of that memory can be decisive for recovery and legal proceedings.
  3. Preserve logs. Export or snapshot firewall logs, Windows Event Logs, and endpoint detection alerts before they rotate or are overwritten.
  4. Limit further logins. Disable or lock accounts that may be compromised. Attackers frequently use stolen credentials to maintain persistence, so every active session is a risk.
  5. Identify the blast radius. Determine which systems are encrypted, which are clean, and whether backups are reachable and intact.
  6. Contact your IT provider and the ACSC. Report the incident at cyber.gov.au. If you hold personal information under the Privacy Act, you may have a mandatory notification obligation to the OAIC.

When to disconnect versus when to contain: disconnect immediately if the infection is actively spreading. If spread appears contained to one machine and you need forensic evidence, isolate it on a separate VLAN rather than pulling the plug.

Pro Tip: Take photos of ransom notes on screen before doing anything else. The note often contains attacker contact details, a wallet address, and a variant identifier that helps investigators and your insurer classify the attack quickly.

How should you structure your backup strategy to survive ransomware?

The 3-2-1 rule is the baseline: three copies of your data, on two different media types, with one copy stored offline or offsite. Against ransomware, the offline or immutable copy is the one that actually saves you. An attacker who compromises your network can reach any backup that is network-accessible, including cloud backups that sync automatically without versioning or immutability controls.

What “immutable” means in practice: an immutable backup cannot be modified or deleted for a defined retention period, even by an administrator. Cloud platforms such as Microsoft Azure Blob Storage and AWS S3 support object lock policies that enforce this. On-premises, an air-gapped drive that is physically disconnected after each backup achieves the same result.

Backup type Ransomware resilience Key requirement
Onsite snapshot (NAS/server) Low without immutability Enable versioning; isolate from production network
Air-gapped external drive High Disconnect after each backup; store offsite
Cloud with versioning and immutability High Enable object lock or equivalent; test restores
Cloud sync without versioning Very low Ransomware encrypts synced files instantly

For cloud backup options suited to small businesses in Queensland, the critical question is always whether immutability is enabled by default or requires manual configuration.

Backup testing checklist:

  • Restore a sample of files from each backup type at least monthly.
  • Run a full system restore test (including Active Directory and email) at least quarterly.
  • Verify that restored accounts and group policies function correctly before signing off.
  • Document the restore time for each system so you know your actual recovery time objective (RTO).
  • Store restore test logs offline and share them with your insurer.

Pro Tip: During a restore test, deliberately try to log in with a recently disabled account. If it works, your AD restore has a gap that ransomware attackers routinely exploit to regain access after recovery.

CISA’s StopRansomware Guide specifically calls out offline, encrypted backups and regular restore testing as the most reliable path to recovery without paying a ransom.

How should you structure your backup strategy to survive ransomware? — overview diagram

Which preventive controls give you the most protection fastest?

Microsoft’s three-step framework is the clearest prioritisation guide available: first, prepare your recovery plan; second, limit the scope of damage; third, make it hard for attackers to get in. Do them in that order, because a tested backup is more valuable than any perimeter control if an attacker is already inside.

The controls below are ranked by impact-to-effort ratio for Australian SMBs.

  • Patch management. Unpatched systems are the most common ransomware entry point after phishing. Automate OS and application updates; treat critical patches as a 48-hour deadline, not a monthly task.
  • Multi-factor authentication (MFA). Enable MFA on every account, starting with email, remote access, and admin consoles. Push-based MFA (approve/deny notifications) is vulnerable to fatigue attacks where attackers spam approval requests until a user accidentally accepts. Where possible, move to phishing-resistant methods such as FIDO2 hardware keys or passkeys.
  • Least privilege and privileged account protection. No user should have local admin rights by default. Separate privileged accounts from daily-use accounts and never use them for email or web browsing.
  • Endpoint detection and response (EDR). EDR tools monitor process behaviour rather than just signatures, which means they can catch novel ransomware variants before they encrypt significant data. Managed detection and response (MDR) adds a human analyst layer.
  • Network segmentation. Flat networks let ransomware spread freely. Segment finance, operations, and IT management onto separate VLANs with firewall rules between them.
  • Disable or restrict RDP. Remote Desktop Protocol exposed to the internet is a primary ransomware entry point. Disable it where not needed; require VPN and MFA where it is.
  • Protective DNS. A DNS filtering service blocks connections to known malicious domains, stopping many ransomware payloads before they execute.
Control Why it matters Quick implementation tip
Patch management Closes known vulnerabilities attackers scan for Enable automatic updates; use a patch management tool for third-party apps
MFA (phishing-resistant) Stops credential-based attacks even if passwords are stolen Deploy FIDO2 keys for admin accounts first
Least privilege Limits blast radius if one account is compromised Audit local admin rights; remove where not required
EDR/MDR Detects behaviour-based threats before encryption spreads Choose a vendor with 24/7 monitoring and rollback capability
Network segmentation Prevents lateral movement across systems Separate finance and IT management VLANs as a minimum
Disable RDP Removes a primary remote-access attack vector Block port 3389 at the firewall; require VPN for remote access
Protective DNS Blocks malicious domains at the resolver level Enable filtering via your DNS provider or a dedicated service

The NCSC’s defence-in-depth guidance groups these controls by preventing delivery, preventing spread, and preventing execution. That framing is useful when explaining the rationale to a non-technical manager: each layer catches what the previous one missed.

Even non-PC devices can be vulnerable. Canon DSLR cameras have been found vulnerable to ransomware, which illustrates why device inventory and firmware patching need to cover the full environment, not just workstations and servers.

How do staff training and operational processes reduce ransomware risk?

Most ransomware starts with a phishing email. Scamwatch documents the techniques attackers use to steal credentials or deliver malware through deceptive messages, and the defence is a combination of technical controls and staff awareness.

Training should cover three things: recognising phishing (suspicious sender addresses, urgency cues, unexpected attachments), safe attachment handling (never enable macros in unexpected documents), and how to report a suspicious message without fear of embarrassment. That last point matters more than most businesses realise. Staff who feel they will be blamed for clicking a link are less likely to report it quickly, which delays containment.

Operational processes that reduce risk:

  • Account lifecycle management. Disable accounts on the day an employee leaves. Dormant accounts are a favourite persistence mechanism for attackers.
  • Vendor and third-party access controls. Limit external access to specific systems, time-bound sessions, and require MFA. Review vendor access quarterly.
  • Onboarding and offboarding checklists. A written checklist prevents the “we forgot to remove their VPN access” scenario that shows up in post-incident reviews.
  • Delegated escalation. Every staff member should know exactly who to call if they suspect an incident, without having to search for a number in a panic.

For a structured approach to cybersecurity training for your team, the cadence that works for most SMBs is quarterly awareness training plus a simulated phishing test every six weeks.

Pro Tip: Run a tabletop exercise at least once a year. Seat your executive, IT lead, communications contact, and legal adviser in a room, present a ransomware scenario, and walk through decisions in real time. CISA offers free tabletop exercise packages that require no technical setup.

Daily hygiene tasks non-technical staff can own: lock screens when stepping away, report unexpected password reset emails immediately, and never plug in a USB device of unknown origin.

How do you build an incident response plan that actually works?

An incident response plan (IRP) that lives in a shared drive and has never been tested is not a plan. It is a document. The difference between the two is whether your team has rehearsed the decisions they will need to make under pressure.

Core IRP elements:

  1. Roles and responsibilities. Name the incident commander, the technical lead, the communications owner, and the legal/privacy contact. Include after-hours phone numbers.
  2. Communications plan. Decide in advance what you will tell staff, customers, and regulators, and who is authorised to say it. Silence during an incident damages trust faster than a measured, honest update.
  3. Recovery priorities. Rank your systems by business criticality. Finance and payroll typically come before internal collaboration tools.
  4. Legal and privacy notifications. Document the threshold for notifying the OAIC under the Notifiable Data Breaches scheme and the timeline (72 hours is the practical target, though the Privacy Act sets a “as soon as practicable” standard).
  5. Backup verification steps. The IRP should include the exact steps to verify backup integrity before starting a restore, not a general note to “check backups.”

Sample restore timeline:

  • Hours 0–4: Isolate, preserve evidence, activate IRP, notify ACSC.
  • Hours 4–12: Assess scope, verify backup integrity, begin restoring priority systems (AD, email).
  • Hours 12–48: Restore finance and operational systems; test functionality before reconnecting to the network.
  • Days 2–7: Restore remaining systems; conduct post-incident review; notify affected parties if required.
  • Weeks 2–4: Patch root cause, harden environment, update IRP based on lessons learned.

Store your IRP in at least one offline location, such as a printed copy in a locked cabinet or an encrypted USB held by the incident commander. If ransomware encrypts your file server, a plan stored only there is inaccessible when you need it most.

How do you build an incident response plan that actually works? — overview diagram

Where do you report a ransomware incident in Australia?

Two agencies handle the bulk of ransomware reporting in Australia, and they serve different purposes.

  • ACSC (Australian Cyber Security Centre): Report at cyber.gov.au. The ACSC provides technical guidance, can connect you with specialist support, and uses incident reports to track threat trends nationally. Reporting does not trigger automatic regulatory action against you.
  • OAIC (Office of the Australian Information Commissioner): Notify if personal information held under the Privacy Act has been accessed or exfiltrated. The Notifiable Data Breaches scheme requires notification to both the OAIC and affected individuals when a breach is likely to result in serious harm.

What to include in your report:

  • Timeline of events (when you first noticed, what systems are affected, estimated time of initial compromise if known).
  • Systems and data affected, including whether personal information is involved.
  • Business impact (operations down, revenue affected, customer services disrupted).
  • Evidence preserved (logs, memory images, ransom note).
  • Backup status (whether clean backups are available and their age).

After reporting, your immediate next steps are to contact your IT provider, follow your IRP, and preserve all evidence in its current state. Do not attempt to clean or rebuild systems before a forensic image is taken.

If customer data is at risk, notify affected individuals promptly. The Privacy Act does not set a fixed number of hours, but the OAIC expects notification “as soon as practicable” after you become aware a breach has occurred.

How do you evaluate EDR, backup, and managed service tools?

The gap between what a vendor claims and what their product does under a real ransomware event is often significant. Independent reviews from outlets such as PCMag provide useful detection benchmarks, but they do not test restore procedures or incident response SLAs, which are what actually determine your recovery outcome.

Feature checklist for EDR and endpoint protection:

  • Behavioural detection (not just signature-based).
  • Automated isolation of compromised endpoints.
  • Rollback capability for encrypted files.
  • Telemetry retention of at least 30 days for forensic investigation.
  • 24/7 monitoring, either built-in or via an MDR partner.

Questions to ask a backup vendor:

  1. Can you show me a restore test log from the last 90 days?
  2. What is your guaranteed restore time for a full system recovery?
  3. Is immutability enabled by default or does it require configuration?
  4. How are backup credentials stored, and are they separate from production credentials?
  5. What is your breach notification timeline if your platform is compromised?

Red flags to avoid:

  • A vendor who suggests paying the ransom as a recovery option.
  • No documented restore test history.
  • Backup credentials stored in the same password manager as production accounts.
  • SLAs that cover uptime but not restore time.

Windows includes a built-in feature called Controlled Folder Access under Windows Security, which blocks unauthorised applications from modifying protected folders. It is worth enabling, but it is not a substitute for EDR or tested backups. Think of it as one layer in a defence-in-depth stack, not a standalone solution.

For SMBs exploring cloud-based data protection, encrypting sensitive data in cloud storage adds a layer of protection that persists even if backup access credentials are stolen.

When should you call a managed IT provider?

Some ransomware incidents are within the capability of an in-house IT team to manage. Many are not. Use this checklist to decide.

Call a managed IT provider immediately if:

  • You do not have tested, offline backups.
  • The infection has spread to more than one system or site.
  • You have evidence of lateral movement (attacker accessed multiple accounts or systems).
  • Personal or financial data may have been exfiltrated.
  • Your recovery time objective is measured in hours, not days.
  • You lack the internal capacity to conduct forensic imaging before rebuilding.

What to demand from any provider you engage:

  • Restore test logs from the last 90 days.
  • Evidence of privilege separation in their own environment (a provider whose team uses shared admin accounts is a risk).
  • A forensic report at the end of the engagement.
  • A fixed-price or capped emergency response option so costs do not spiral during a crisis.

42% of cyberattacks target small businesses, which means the probability of an SMB facing a ransomware event is not hypothetical. Managed services provide continuous monitoring and tested response procedures that most SMBs cannot replicate in-house.

Pro Tip: Before signing with any managed IT or security provider, ask them to run a restore test on a sample of your data as part of the onboarding process. A provider who declines or defers that request is telling you something important about how they operate.

For a broader view of how cyber hygiene and business continuity planning intersect for small businesses, the cybersecurity survival guide for SMBs from Ready Accounting covers practical risk prioritisation that applies regardless of jurisdiction.

Does cyber insurance cover ransomware incidents?

Cyber insurance can cover ransom payments, data recovery costs, business interruption losses, legal fees, and regulatory fines arising from a ransomware incident. The coverage varies significantly between policies, and the conditions for a valid claim are more demanding than most business owners expect.

Insurers increasingly require evidence of specific controls before they will issue a policy or pay a claim. MFA on remote access and email, tested backups, and an incident response plan are now standard requirements at most insurers. A business that cannot demonstrate these controls at the time of a claim may find the claim denied.

A few practical points worth knowing before you buy or renew:

  • Sub-limits on ransom payments are common. A policy with a $5 million limit may cap ransom payments at $500,000.
  • Waiting periods apply to business interruption coverage. Most policies require a minimum outage period (often 8–12 hours) before interruption losses are claimable.
  • Proof of controls at the time of the incident, not just at policy inception, is what insurers examine. If you disabled MFA on a system six months after taking out the policy, that gap can void the relevant claim.
  • Ransomware payment reporting. Australia does not currently mandate reporting of ransom payments to a government authority, though the Ransomware Payments Bill has been discussed in Parliament. Check current requirements with your legal adviser before making any payment.

Cyber insurance is a financial backstop, not a security strategy. It works best when layered on top of the technical controls described in this article, not instead of them.

The Privacy Act 1988 (Cth) and the Notifiable Data Breaches (NDB) scheme are the primary legal frameworks that apply when ransomware results in unauthorised access to personal information.

Under the NDB scheme, an organisation covered by the Privacy Act must notify the OAIC and affected individuals when a data breach is likely to result in serious harm. “Serious harm” includes financial harm, reputational damage, and physical harm. A ransomware attack that encrypts personal data without confirmed exfiltration still requires an assessment of whether notification is warranted, because the attacker had access to the data even if you cannot confirm they copied it.

Key obligations:

  • Conduct an assessment of whether a breach has occurred within 30 days of becoming aware of the incident.
  • Notify the OAIC and affected individuals as soon as practicable if the assessment confirms a likely serious harm.
  • Notify the OAIC using the online notification form on the OAIC website.

Sector-specific obligations may also apply. Healthcare organisations are subject to the Australian Privacy Principles under the Privacy Act. Financial services firms regulated by APRA face additional incident reporting requirements under CPS 234. Critical infrastructure operators have obligations under the Security of Critical Infrastructure Act 2018.

Paying a ransom may also carry legal risk. Payments to sanctioned entities or individuals are prohibited under Australian sanctions law administered by the Department of Foreign Affairs and Trade (DFAT). Before authorising any payment, seek legal advice and check the DFAT consolidated sanctions list.

This section provides general information only. Consult a qualified legal adviser for advice specific to your situation and obligations.

The mistake most Australian SMBs make with ransomware

The most common pattern seen in Australian SMBs is not a failure of technology. It is a failure of testing. Businesses invest in backup software, configure it once, and then assume it works. They discover it does not when they need it most, often because a configuration change months earlier broke the backup job silently, or because the restore process takes four times longer than expected and the business cannot absorb the downtime.

The second most common mistake is treating MFA as a checkbox rather than a genuine control. Push-based MFA is better than nothing, but it is not the finish line. Attackers have refined MFA fatigue techniques to the point where a tired or distracted employee will approve a fraudulent request. The businesses that hold up best are the ones that moved privileged accounts to phishing-resistant authentication before they needed to.

Techbug has over 30 years of combined experience working with Australian SMBs, and the pattern is consistent: the businesses that recover fastest from ransomware are the ones that tested their backups last month, not the ones with the most expensive endpoint protection.

The habit to start today is simple. Pick one system, restore a file from last week’s backup, and time how long it takes. If you cannot do it in under an hour, you have found your most urgent gap.

How Techbug helps Australian businesses stay protected

Ransomware protection for business is not a product you buy once. It is a set of maintained controls, tested procedures, and people who know what to do when something goes wrong.

Techbug

Techbug provides managed IT security services for Australian SMBs, including ransomware-safe backup configuration and testing, EDR deployment and monitoring, staff phishing awareness training, and emergency incident response. The team is vendor-agnostic, which means the solution fits your environment rather than a preferred product catalogue.

For businesses that need ongoing protection, Techbug’s managed IT services include proactive monitoring, patch management, and a response team available when an incident occurs. For a one-off engagement such as IRP development, a backup audit, or a post-incident forensic review, IT consulting is available on a project basis.

To get an emergency response or book a backup audit, contact Techbug directly through Techbug.

Sources