Use this route for ransomware, an active intrusion or a suspected breach. Share only enough high-level information for safe contact. Do not upload evidence, credentials, malware or classified material.
If life or safety is at immediate risk
Call Triple Zero (000) for police, fire or ambulance in Australia.
Safe first actions
Limit spread safely
Disconnect affected devices from the network where safe. Avoid an uncoordinated mass shutdown.
Preserve evidence
Keep logs, ransom notes, email headers and system state. Do not reinstall or wipe yet.
Use trusted communications
Coordinate from a device and channel you reasonably believe are not compromised.
Delay irreversible decisions
Do not pay, negotiate or connect backups before understanding the incident and recovery risk.
Read ransomware in the first hour, review official ASD ransomware guidance, and report cybercrime through ReportCyber when you are able.
Urgent contact route
Request incident contact
High-level details only. No files or evidence.What happens after you contact us
Review
A person reviews the high-level metadata and safe contact route.
Contact
The team replies using the safe email address you supplied.
Authorise
Any work requires a separate agreement, authority and defined scope.
Handle privately
Evidence transfer, if needed, is arranged outside this public website.
What this route cannot promise
Limitations
We cannot guarantee decryption, complete recovery or a specific response time. Submitting this form does not authorise work or replace official emergency and reporting channels.