In the first hours of a ransomware incident, the decisions you make determine what you can recover and what you can prove. We help you contain the spread, preserve the evidence you will need, remove the actual point of compromise (not just the ransom note) and validate that recovery is genuinely clean.
Ransomware response is the coordinated containment, investigation, eradication and recovery of systems affected by encryption, extortion or related intrusion activity. Recovery is not only restoring files: the access path must be understood and closed before restored systems can be trusted.
If this is happening now, do not upload files here. Use Get incident help. If anyone is in immediate physical danger, call Triple Zero (000) first.
Official Australian guidance on ransomware is published by the Australian Signals Directorate. We align advice with that guidance and we do not encourage paying a ransom. See cyber.gov.au ransomware advice.
Ransomware first-response priorities
Limit spread
Isolate affected systems from networks where this can be done safely; avoid uncoordinated mass shutdowns.
Protect evidence
Preserve logs, volatile state, ransom notes and suspicious artefacts before rebuilding.
Protect communications
Assume ordinary channels may be observed and establish an appropriate incident channel.
Record decisions
Track actions, times and owners so response, reporting and recovery remain defensible.
Do not upload incident evidence here
Use the incident-help route for high-level contact details only. Evidence transfer is arranged privately after authority and handling requirements are confirmed.
Current landscape
The first objective is not to make the ransom note disappear. It is to stop spread while preserving the evidence and recovery options needed for a clean return.
ASD’s ACSC reported that ransomware was involved in 11% of incidents it responded to in FY2024–25, unchanged from the prior year, while reported data breaches and average losses rose. Large-business self-reported cost per cybercrime report jumped 219% to $202,700. Ransomware is not “solved”. It is a stable share of a growing incident load. Source: ACTR 2024–25.
Medibank’s 2022 incident is the Australian reference case for extortion against health data. Initial access was a stolen contractor credential to a VPN without MFA. The board announced it would not pay, consistent with Australian Government position. Attackers then published health claims data. Subsequent Federal Court argument over whether forensic reports attracted legal professional privilege is a warning: how you commission due diligence after an incident affects what you can later claim. We do not discuss privileged facts from that matter; we use the public record.
ASD’s published incident-support advice asks organisations to report cyber security incidents via ReportCyber or 1300 CYBER1, and to preserve indicators of compromise, compromised credentials and ransomware precursor activity. First-hour mistakes, mass reimaging, public sample upload, paying immediately, destroy the evidence needed for eradication. See ransomware in the first hour.
(ISC)² splits this work into incident response, business continuity (BC) and disaster recovery (DR). BC keeps critical operations going; DR reinstates regular operations; neither is a decryption guarantee. Maximum allowable downtime (MAD) is a business figure we will not invent for you. Official ASD ransomware page: cyber.gov.au.
When this fits
Active encryption
Systems are being encrypted or disrupted and spread must be contained safely.
Extortion or data theft
An actor claims data access or threatens publication and the evidence needs investigation.
Recovery uncertainty
Backups or restored systems exist, but their integrity and the original access path are unclear.
Post-incident review
Operations are stable and you need a defensible timeline, root cause and hardening plan.
Decisions and outcomes
Response is structured to answer: how do we stop this spreading right now; what must be preserved before it is lost; how do we remove the actual point of compromise; and how do we confirm, not assume, that recovery is clean.
Scope
Typically included
- Containment guidance to limit further spread
- Evidence preservation practices appropriate to the incident
- Eradication support targeting the root cause, not only visible symptoms
- Recovery validation and a post-incident review
Not included unless agreed
- Any guarantee of successful decryption or complete data recovery
- Encouragement or facilitation of ransom payment
Deliverables
- An incident timeline
- Indicators of compromise
- A recovery plan
- A post-incident review with hardening recommendations
Process
Contain
Stop further spread safely.
Preserve
Protect evidence before it is lost.
Eradicate
Remove the compromise, not just the symptom.
Restore and verify
Bring systems back and confirm they are clean.
Methods and standards
Guidance aligns with current official ASD ransomware guidance. See cyber.gov.au. Report cybercrime to ReportCyber. If personal information is involved, consider OAIC notifiable data breach obligations.
Security and evidence
No public evidence upload
This page never accepts malware, source code or evidence. Secure transfer is agreed only after authorisation and scoping, outside this website.
Limitations
What this engagement cannot promise
We do not guarantee decryption or complete recovery, and we do not encourage paying a ransom. Response times are published only when staffing and coverage are verified.
Common questions
What should we do in the first hour of ransomware?
Prioritise safety, isolate affected systems where safe, preserve evidence, protect trusted communications and record actions. Avoid mass reimaging, public sample uploads or immediate payment decisions. See ransomware first-hour actions and use incident help for high-level contact details.
Should we pay the ransom?
We do not encourage payment. Payment does not guarantee decryption, does not remove the attacker, and may create further legal and reporting issues. Contain, preserve evidence, and get advice before any negotiation. ASD’s public position is the starting point.
Should we power everything off?
Uncoordinated shutdowns can destroy volatile evidence and interrupt containment. Isolate affected systems from the network if you can do so safely, leave powered-on machines in a known state if possible, and get a responder involved before mass rebuilds. See first-hour ransomware actions.
Can you decrypt the files?
No honest specialist can promise that. Some families have public decryptors; many do not. Recovery is usually from known-good backups, after the access path has been closed, not from a miracle key.
Case Studies
Current published case studies. Public-source illustrations are labelled clearly and are not presented as client engagements. View all case studies.
Six gift cards and a forged executive
A courier employee bought six $500 prepaid cards after mail that looked like it came from an executive. There was no malware. The missing control sat in the payment process.
More than $150,000 to a supplier who never changed banks
A construction firm paid an invoice twice after a supplier mailbox was taken over. No callback. No funds recovered.
The backup that encrypted itself
Ransomware at an auto parts store encrypted the live files and the backup disk still plugged into the same machine. Years of data went with the old system.
Related
Ready to talk about your situation?
Tell us the high-level scope. No malware, source code or evidence – just enough for us to route you safely.