Ransomware for a 10-Person Sydney Office: First 24 Hours
In the first 24 hours after ransomware, focus on containment, communication, clean recovery and identity. Do not experiment on infected machines. For a small Northern Beaches or North Shore office, speed and calm process beat panic reinstalls.
On this page
Hour 0–1: contain
- Isolate affected PCs from Wi-Fi and LAN if safe to do so
- Preserve one untouched encrypted sample if possible (for insurers/forensics)
- Disable risky remote access until passwords and MFA are reviewed
- Call your IT provider — do not run random decryptor tools from ads
- Call ASD’s Australian Cyber Security Hotline, 1300 CYBER1 (1300 292 371), open 24/7, and report at cyber.gov.au/report
Hour 1–4: establish facts
- What is encrypted (files, servers, M365)?
- Which accounts signed in unusually?
- Are backups offline or immutable, or also hit?
- Who needs to know (owners, staff, key clients if services are down)?
Hour 4–24: recover and harden
- Restore from known-good backups after malware is cleared from restore path
- Reset credentials; prioritise admin and email
- Review MFA, app passwords, OAuth grants on Microsoft 365
- Document timeline for insurance
Legal clocks that start running
| Obligation | Who it applies to | Deadline |
|---|---|---|
| Assess a suspected eligible data breach (Notifiable Data Breaches scheme) | Businesses over $3M turnover, plus smaller health service providers and businesses that trade in personal information | Reasonable steps to assess within 30 calendar days; notify the OAIC and affected people if serious harm is likely |
| Report a ransom payment (Cyber Security Act 2024) | Businesses over $3M turnover in the previous financial year | Within 72 hours of paying, or of learning a payment was made. In force since 30 May 2025 |
Most 10-person offices sit under the $3 million line, but a medical or allied-health practice is inside the breach scheme whatever its turnover. Check with your insurer before any payment decision.
Related: Microsoft 365 backup, DR one-pager, managed IT.
FAQ
Should we pay the ransom?
That is a legal, insurance and leadership decision. Technical priority is contain, assess backups, and restore cleanly — do not assume payment restores trust.
Is turning everything off correct?
Containment matters, but random power-offs can destroy forensic evidence and shared services. Use a short decision tree with your IT provider.
How do we reduce odds next time?
MFA, least privilege, tested M365 and file backups, patching, and phishing-resistant habits.
Do we have to report a ransomware attack?
Reporting to ASD at cyber.gov.au/report is voluntary for most small businesses and gets you free incident advice. It becomes mandatory if your business turns over more than $3 million and pays a ransom: that payment must be reported within 72 hours. A data breach likely to cause serious harm must also be notified to the OAIC under the Notifiable Data Breaches scheme.
Related service: Business IT support · contact eWEB TEC.
Need help containing or recovering?