by The Computing Australia Group | 
A ransomware attack can stop a business in its tracks. Criminals lock your files and systems, often steal your data as well, and then demand payment to give it back or keep it quiet. For a small or medium business, the disruption can last weeks.
This guide explains how a ransomware attack works, how to prevent one, exactly what to do in the first hours if you’re hit, and how to recover safely. It’s written in plain English for business owners and managers, with a checklist you can use today.
Updated 4 November 2026
What’s changed since this guide was first published
- ASD’s 2025–26 threat report is out. ASD responded to 139 ransomware incidents, and the most serious ones rose from 16 to 24. It also warns that AI is making attacks faster and more convincing.
- Ransom payments must be reported. Since 30 May 2025, organisations with turnover over $3 million must report a ransomware payment to ASD within 72 hours.
- ASD Essentials has arrived. Published on 15 October 2026, it succeeds the Essential Eight as ASD’s baseline for cyber security.
- Privacy reform is on the way. A draft bill released on 31 August 2026 proposes faster notification of data breaches.
What is a ransomware attack?
Ransomware is malicious software that locks you out of your files or systems. Today, most attacks involve more than locking files, though. Criminals usually combine several tactics to put pressure on you to pay.
Encryption
Your files, servers and sometimes backups are scrambled so you can’t use them.
Data theft
Before locking anything, attackers often copy sensitive data to their own servers.
Extortion
They then threaten to publish or sell that data unless you pay, even if you can restore your files.
An attack can affect a single laptop or an entire network, including cloud accounts and business applications. Many groups now run ransomware as a business, selling their tools to other criminals. Read more in our guide to ransomware-as-a-service.
How a ransomware attack gets into your business
Attackers usually take the easiest path available. In most cases, that means one of the routes below. ASD also warns that AI is helping criminals write more convincing scam emails and find weaknesses faster.
Phishing emails
Fake invoices, delivery notices or file-share links that trick someone into clicking or entering a password.
Stolen passwords
Reused or leaked passwords let attackers log straight in, especially where multi-factor authentication is missing.
Unpatched systems
Out-of-date firewalls, VPNs, servers and website plugins with known security flaws.
Exposed remote access
Remote desktop and similar tools left open to the internet, often with weak passwords.
Suppliers and partners
A compromised supplier, software update or IT tool can provide a back door into your systems.
Fake downloads
Malicious ads and look-alike websites that offer free software laced with malware.
What happens during a ransomware attack
A ransomware attack rarely happens all at once. In fact, attackers often spend days or weeks inside a network before anyone notices. Understanding the typical stages shows where good security can stop them.
- Getting in. The attacker gains a foothold through phishing, a stolen password or an unpatched system.
- Settling in. They create hidden accounts or tools so they can return even if a computer restarts.
- Taking control. Next, they hunt for administrator passwords that give them the keys to your network.
- Spreading. They map your servers, file shares, backups and cloud services, then move between them.
- Stealing data. Sensitive files are copied out of your business, ready to be used for extortion.
- Striking. Finally, they delete or lock backups, encrypt your systems and leave a ransom note.
How to prevent a ransomware attack
No single product stops ransomware. Instead, layers of protection work together, so that if one fails, another catches the attack. Start with the essentials below, then build up.
The essentials every business needs
- Patch promptly. Keep operating systems, applications, firewalls and website plugins up to date, and prioritise anything facing the internet.
- Use endpoint detection and response. Modern endpoint protection watches for suspicious behaviour and can isolate an infected device automatically.
- Turn on multi-factor authentication. Use it for email, remote access, cloud admin and backup systems, ideally with phishing-resistant methods such as passkeys.
- Keep backups attackers can’t reach. Hold several copies, including one offline or unchangeable, and test that you can actually restore them.
- Limit admin rights. Give people only the access they need, and use separate accounts for administrator tasks.
- Filter email and web traffic. Block dangerous attachments and links, and set up SPF, DKIM and DMARC to stop people impersonating your domain.
- Close remote access gaps. Never leave remote desktop open to the internet. Instead, use a secure gateway with multi-factor authentication.
- Monitor around the clock. Attacks often start at night or on weekends, so someone needs to be watching for warning signs.
Use ASD’s framework as your guide
The Australian Signals Directorate’s Essential Eight has been the go-to baseline for Australian businesses for years. In October 2026, ASD published ASD Essentials as its successor, and both remain available during the transition. Either way, these frameworks give you a clear, prioritised way to measure your defences. Learn more about the Essential Eight.
Plan before you need it
Write a short incident response plan that names who does what, who to call and how you’ll communicate if email is down. Then rehearse it with a simple tabletop exercise. Finally, check what your cyber insurance covers and what it requires of you before you ever need to claim.
Help your team spot the warning signs
Your people are often the first line of defence. Regular, practical training makes a real difference, especially as scams become harder to spot. Encourage these habits:
- Pause before clicking. Check the sender’s address and be wary of urgent or unusual requests.
- Verify payment changes by phone. Use a known number, never the one in the email.
- Use a password manager. Unique passwords for every account stop one leak from becoming many.
- Report mistakes straight away. A quick report, without blame, can stop an attack spreading.
- Be careful with downloads. Only install software approved by your IT team.
- Lock your screen. Especially in shared spaces or when working remotely.
If you’re hit: what to do in the first hours
If you suspect a ransomware attack, act quickly but calmly. Your first goals are to stop it spreading and to protect the evidence and backups you’ll need to recover.
Isolate
Disconnect affected devices from the network and Wi-Fi. Avoid switching them off unless your IT team advises it.
Call for help
Contact your IT provider straight away, and call your cyber insurer if you have cover.
Protect backups
Disconnect backup systems and lock their admin accounts so they can’t be deleted.
Lock down accounts
Reset administrator passwords first, then other accounts, and sign out suspicious sessions.
Record everything
Photograph ransom notes and write down what happened and when.
Report it
Report to ASD through ReportCyber or call 1300 CYBER1 (1300 292 371).
What not to do
- Don’t delete files or wipe devices yet. You may destroy evidence needed to understand the attack.
- Don’t contact the attackers yourself. Get expert advice first.
- Don’t use compromised email or chat to coordinate. Switch to phones or a separate, clean channel.
Should you pay the ransom?
ASD advises against paying a ransom. Payment doesn’t guarantee you’ll get your data back or that stolen data will be deleted. It can also mark your business as willing to pay, which makes you a target again.
If your organisation does make a payment and has an annual turnover of more than $3 million, you must report it to ASD within 72 hours. Because the decision has legal, financial and ethical consequences, discuss it with your insurer, legal adviser and IT team before acting.
Recovering from a ransomware attack
Once the attack is contained, recovery follows a clear sequence. Rushing it can let attackers straight back in, so work through each stage properly.
Investigate
Work out how the attackers got in, what they touched and whether data was stolen.
Remove
Delete malware, hidden accounts and tools, and fix the weakness they used.
Rebuild cleanly
Rebuild affected systems from trusted sources rather than simply cleaning them.
Restore
Restore data from backups you’ve confirmed are clean and from before the attack.
Reset
Change every password, access key and certificate the attackers could have seen.
Learn
Review what happened, update your plan and fix the gaps.
You may also have legal obligations. Under the Notifiable Data Breaches scheme, organisations covered by the Privacy Act must notify affected people and the OAIC if a breach is likely to cause serious harm. If you’re unsure whether this applies to you, get legal advice early.
Your ransomware attack readiness checklist
Use this quick checklist to see where your business stands. Any “no” answer is a good place to start.
- Backups: Do we have an offline or unchangeable copy, and have we tested a full restore recently?
- Multi-factor authentication: Is it on for email, remote access, cloud admin and backups?
- Patching: Are internet-facing systems updated promptly?
- Monitoring: Would anyone notice an attack at 2am on a Sunday?
- Admin access: Are administrator accounts limited and separate from everyday accounts?
- Training: Has every staff member had phishing training in the past year?
- Plan: Do we have a written incident response plan with phone numbers that work if email is down?
- Insurance: Do we know what our cyber policy covers and requires?
Not sure whether your business has already been compromised? Our guide to the signs your company has been hacked explains what to look for.
How CAG helps protect you from a ransomware attack
Our Perth team in Belmont brings 21 years of IT experience to protecting local businesses. We build layered defences, test them, and help you respond if something gets through.
Monitoring and protection
24/7 monitoring, plus endpoint detection and response that automatically contains threats.
Prevention and training
Multi-factor authentication, security audits, penetration testing, phishing simulations and awareness training.
Backup and recovery
Tested backups and recovery plans, plus rapid response, including after hours for serious incidents.
If you’re hit, our team can help you contain the attack, preserve evidence and restore from backups. Explore our cyber security services, disaster recovery services and computer forensics.
Ransomware protection
Find out how ready your business is
Tell us about your systems and we’ll explain where the gaps are, in plain language. Facing an attack right now? Call our team on 1300 790 166.
Ransomware attack FAQs
Prevention
Are small businesses really targeted by ransomware?
Yes. Many attacks are automated and look for any weakness, whatever the size of the business. Smaller businesses can also be attractive because they often have fewer defences.
Isn’t antivirus enough to stop ransomware?
Not on its own. Traditional antivirus misses many modern attacks. You need several layers, including endpoint detection and response, multi-factor authentication, patching, monitoring and tested backups.
How often should we test our backups?
Run a sample restore every few months and a full recovery test at least once a year. Also check that at least one copy is offline or can’t be changed.
Response and recovery
Do we have to report a ransomware attack?
You should report it to ASD through ReportCyber. If you pay a ransom and your turnover is over $3 million, reporting the payment within 72 hours is mandatory. You may also need to notify affected people under the Notifiable Data Breaches scheme.
How long does recovery take?
It depends on how far the attack spread and the state of your backups. Businesses with clean, tested backups and a rehearsed plan usually recover much faster.
Can CAG help after a ransomware attack?
Yes. Our team can help you contain a ransomware attack, preserve evidence and restore your systems from backups. For serious incidents, our emergency response is also available outside business hours. Call 1300 790 166 or contact our team.
Sources and further reading
- business.gov.au — Annual Cyber Threat Report 2025–26 outlines cyber threats facing Australian businesses
- The Missing Link — What ASD’s Cyber Threat Report 2025–26 means for Australian businesses
- Australian Signals Directorate — Ransomware and cyber extortion payment reporting
- Australian Signals Directorate — ASD Essentials: evolving our approach to cyber security resilience
- Australian Signals Directorate — Report a cyber security incident
- OAIC — Notifiable Data Breaches scheme
- Gadens — Tranche 2 privacy reforms: key changes
This guide is general information, not legal advice. Check with your legal adviser and insurer about your obligations. Last reviewed 4 November 2026.
About the author
Gordon Murdoch
Director (Policy, Compliance and Training), The Computing Australia Group
Gordon leads CAG’s policy, compliance and training work. He helps organisations turn security requirements into practical policies their teams can actually follow, and drives projects that use AI and other tools to lift efficiency and service quality. His view is simple: compliance should make a business stronger, not just tick a box.
