Ransomware Response Checklist Australia

A practical, print-friendly Australian ransomware response checklist for the first hour, first 24 hours and first week after a suspected incident. It includes containment, evidence preservation, reporting, recovery and follow-up actions.

Important: If there is an immediate threat to life or physical safety, call 000. Do not use this checklist as a substitute for legal, insurance, privacy or incident-response advice.

Before You Begin

Use a clean device that is not connected to the affected network.
Record the time the incident was discovered and who first noticed it.
Start an incident log. Record every decision, person contacted and action taken.
Do not delete ransom notes, logs, suspicious emails or affected devices.

The First Hour: Contain the Incident

Disconnect affected computers and servers from wired and wireless networks.
Disable Bluetooth and other network connections on affected devices.
Isolate affected network segments where this can be done safely.
Do not power devices off unless encryption is actively spreading and isolation is impossible.
Disable compromised user accounts and revoke active sessions.
Preserve ransom notes, file extensions, screenshots and relevant timestamps.
Notify the nominated incident lead and senior decision-maker.
Contact your managed IT or incident-response provider using a clean communication channel.

The First 24 Hours: Assess and Escalate

Identify affected systems, accounts, cloud services and business processes.
Determine whether data may have been accessed or stolen as well as encrypted.
Check whether privileged, administrator or service accounts were compromised.
Preserve logs from firewalls, endpoints, identity platforms, email and cloud services.
Contact your cyber insurer before committing to external costs or negotiations.
Report the incident to the Australian Signals Directorate through ReportCyber or call 1300 CYBER1 (1300 292 371).
Obtain legal and privacy advice about notification obligations.
Prepare a controlled internal and external communications plan.
Verify that backups are isolated, intact and not infected before attempting restoration.

Recovery: Restore Safely

Confirm the initial access method has been identified and closed.
Rebuild affected systems from trusted media rather than simply decrypting them in place.
Reset passwords, rotate keys and revoke tokens, starting with privileged accounts.
Apply security updates and harden remote access services.
Restore a small number of systems first and monitor them before wider recovery.
Validate restored data and business processes with their owners.
Increase monitoring for renewed attacker activity.
Document evidence, costs, downtime and recovery decisions.

The First Week: Learn and Improve

Run a structured lessons-learned review without assigning blame.
Update the incident-response plan and contact list.
Retest backup restoration and recovery-time expectations.
Prioritise controls that would have prevented or limited the incident.
Brief staff on the lessons relevant to their roles.

Should You Pay the Ransom?

Payment does not guarantee that data will be restored, deleted or kept private. It can also fund further criminal activity. Involve law enforcement, your insurer, legal advisers and an experienced incident-response provider before making any decision.

Authoritative Resources

Reduce Your Exposure Before an Incident

Use our Essential Eight self-assessment, read how ransomware affects Australian businesses, or arrange a Cybersecurity Health Check.

Book a Free Consultation