Failures, incidents and official sources
Ransomware incident: the first 72 hours, who to call and which clocks start
A practical timeline for an Australian business hit by ransomware: containment, the ACSC hotline, insurer notice, the Privacy Act 30-day assessment and 72-hour ransomware payment reporting.
In the first hours of a ransomware incident, an Australian business should contain the attack (isolate affected devices, disable compromised accounts, protect backups), call for help (your managed security or incident-response provider, and the Australian Cyber Security Hotline on 1300 CYBER1), notify your insurer as the policy requires, and preserve evidence. Several legal clocks may start: the Privacy Act requires a suspected eligible data breach to be assessed within 30 days; if the business has turnover above $3 million and a ransom is paid, the Cyber Security Act 2024 requires a report within 72 hours of the payment; and critical infrastructure entities have SOCI Act deadlines of 12 or 72 hours. Knowing these in advance is the cheapest preparation you can buy.
This guide belongs to the failures pillar. It is general information, not legal advice: in a real incident, get legal advice early.
The clocks that may apply
| Obligation | Who | Deadline | Where |
|---|---|---|---|
| Privacy Act NDB assessment | Businesses covered by the Privacy Act (and TFN recipients for TFN information) | Take reasonable steps to complete within 30 days of suspecting an eligible data breach | Assessment internally; notify OAIC and individuals as soon as practicable if eligible |
| Ransomware payment report (Cyber Security Act 2024) | Turnover above $3 million in the previous financial year, or SOCI Part 2B responsible entities | Within 72 hours of making the payment or becoming aware it was made | Through ASD's ACSC at cyber.gov.au |
| SOCI critical incident report | Responsible entities for critical infrastructure assets | 12 hours (significant impact on availability) or 72 hours (relevant impact) | ASD's ACSC |
| Insurance policy notification | Policyholders | As stated in the policy, sometimes very short | Insurer's incident hotline or broker |
| Contractual notification | Depends on customer contracts | Often 24–72 hours | As per contract |
See the Privacy Act guide and the Cyber Security Act guide for the details.
Hour 0 to 4: contain and call
- Do not switch everything off blindly. Disconnect affected devices from the network (unplug or disable Wi-Fi) but, where possible, leave them powered on so memory evidence is not lost. Your provider will guide you.
- Call your provider's incident line, then the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371). Businesses with 19 or fewer employees can also get free help from IDCARE's Small Business Cyber Resilience Service on 1800 595 170.
- Protect backups. Disconnect backup systems and change backup admin credentials from a clean device.
- Disable compromised accounts and reset privileged passwords from a known-clean device; revoke active sessions.
- Call your insurer or broker using the incident number in the policy. Many policies require using a panel firm or getting consent before spending.
- Start an incident log: times, actions, who decided what. Every report later relies on it.
Hour 4 to 24: scope and decide
- Engage a lawyer with incident experience. Some businesses engage forensic responders through their lawyer; take advice on whether this suits you.
- Scope the damage: which systems are encrypted, whether data was exfiltrated (copied out) as well as encrypted. Modern extortion often involves both.
- Preserve evidence: logs, ransom notes, communications with the attacker, disk images. The ransomware payment report asks for variants, vulnerabilities exploited and communications.
- Communicate internally: what staff should and should not do, and a single spokesperson.
- Decide who has authority to approve or refuse any payment. The law does not prohibit payment, but sanctions laws may prohibit paying certain groups, and payment does not guarantee data is deleted or keys work.
Hour 24 to 72: recover and report
- Recovery: restore from clean backups into a cleaned environment, in priority order. Rebuild rather than "clean" compromised servers where possible.
- Payment report: if the business is a reporting business entity and a payment was made (by you or someone on your behalf, such as a negotiator), the report is due within 72 hours of the payment.
- NDB assessment continues: work out what personal information was accessed. If the assessment shows an eligible data breach, prepare the OAIC statement and notify individuals as soon as practicable; do not wait for day 30.
- Customers and suppliers: check contractual notice duties.
- Report to police through ReportCyber at cyber.gov.au if you have not already.
What your managed provider should do, and what it may not
| Task | Usually in MDR scope | Often extra |
|---|---|---|
| Detect and contain | Yes | |
| Forensic imaging and investigation | Yes, IR retainer or hourly | |
| Determining what data was accessed | Partly (from logs) | Detailed analysis usually extra |
| Recovery and rebuild | Often your IT provider, billed separately | |
| Drafting regulatory reports | Usually lawyer or IR firm | |
| Negotiation with attackers | Specialist, often via insurer |
Agree this split before an incident; it is the core of an incident response plan.
Preparation checklist
- Incident response plan with names, numbers and the clocks above, printed and stored offline.
- Insurer's incident number and policy conditions.
- Provider and IR retainer contacts.
- A tested restore of key systems.
- A decision on who can authorise a payment, and in what circumstances the business would consider it.
- A tabletop exercise once a year.
Frequently asked questions
Should we pay the ransom?
That is a business decision to make with legal advice, your insurer and law enforcement input. Paying does not guarantee recovery or deletion of stolen data, and if you are a reporting business entity you must report the payment within 72 hours.
Does reporting to the ACSC satisfy the OAIC?
No. They are separate obligations. A ransomware payment report or ACSC incident report does not replace an NDB notification to the OAIC.
Is our provider allowed to make the report for us?
Someone can prepare it, but the obligation sits with the reporting business entity. Make sure someone owns it.
What if we are under $3 million turnover?
The ransomware payment reporting obligation does not apply, but voluntary reporting to the ACSC is encouraged, and other obligations, such as contracts or the Privacy Act exceptions, may still apply.
Sources
- ASD's Australian Cyber Security Centre — 1300 CYBER1 hotline, ReportCyber and ransomware payment reporting
- IDCARE — Small Business Cyber Resilience Service
- Office of the Australian Information Commissioner — Notifiable Data Breaches scheme and reporting
- Department of Home Affairs — Cyber Security Act 2024
- Department of Foreign Affairs and Trade — Australian sanctions
