First hour of an incident

Something's wrong. Here's the first hour, step by step.

The costliest mistakes in an incident happen early: a wiped laptop, a rushed ransom payment, a customer email sent before anyone checked the facts. Contain without destroying evidence, call the right people in the right order, and write everything down. Build your own first-hour card below.

Australian contacts and reporting rules checked 31 October 2026. General information, not legal advice.

Get help now Build your card 07 3114 2808

Minute-by-minute steps
Who to call, in order
Your first-hour card

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A business owner on a desk phone call pulls a network cable from the wall port to isolate a computer. — **ACSC 1300 292 371**1300 CYBER1. Free, around the clock.

Minute by minute

Three phases in the first hour.

Contain, call, record. In that order.

0 to 15 minutes: contain

Disconnect affected machines but leave them on. Block suspect accounts. Snapshot virtual machines.

Isolate
Block sign-in
Don't wipe

First-hour card

Build the first-hour steps for your situation.

Five questions. You get the steps in order, with the numbers to call, ready to copy or print and keep by the phone.

Answer five questions. You get the first-hour steps for your situation, in order, ready to copy or print. Nothing you choose leaves this page.

What has happened?

Do you have cyber insurance?

Has money already moved?

Could personal information be involved?

Is annual turnover over A$3 million?

Your first hour

8 steps

1. Block sign-in for the account and revoke its sessions. Do not delete it.
2. Check for new mailbox rules, forwarding and MFA methods, and note what you find.
3. Call your cyber insurer's incident line, as your policy requires.
4. Call your IT provider, or the ACSC hotline on 1300 292 371 (1300 CYBER1) if you have none.
5. Start a timestamped log of everything seen and done. Use a phone or a clean device if email may be compromised.
6. Personal information may be involved: start a Notifiable Data Breaches assessment. You have up to 30 days to assess, and must notify promptly if serious harm is likely.
7. Report the cybercrime through ReportCyber at cyber.gov.au.
8. Point affected people to IDCARE on 1800 595 160 for free support.

ACSC 1300 292 371 Get help now

Minutes 0 to 15

Contain, don't destroy.

Work out what is affectedOne odd email is a different incident to encrypted file servers.
Isolate, don't power offUnplug the network cable or turn off Wi-Fi. Leave the machine running.
Block suspect accountsBlock sign-in and revoke sessions. Don't delete the account.
Snapshot before rebuildingVirtual machines and cloud workloads captured first.

Minutes 15 to 30

Who to call, in order.

1. Your cyber insurerTheir incident line, as the policy requires. They can engage forensics and legal help.
2. Your IT providerThey hold the logs and admin access. If you have none, call the ACSC on 1300 292 371.
3. LeadershipThe people who will make decisions about money, staff and customers.
4. Legal adviceBefore any statement to customers or the public. Insurer panel lawyers often move fastest.
5. Your bank, if money movedThe fraud line straight away. Recall windows are short.

Common mistakes

What not to do in the first hour.

Don't pay a ransom yetGet legal advice. Paying a sanctioned group can be a criminal offence.
Don't wipe or rebuildYou destroy evidence and can't confirm the attacker is gone.
Don't communicate externally yetNo customer emails or posts until legal has reviewed.
Don't use the compromised mailboxThe attacker may be reading it.
Don't delete suspicious emailsThey are evidence.

Australian obligations

The reporting rules that may apply.

Rule	What it requires	Applies to
Notifiable Data Breaches	Assess a suspected breach within 30 days; notify the OAIC and affected people promptly if serious harm is likely	Organisations covered by the Privacy Act
Ransomware payment reporting	Report any ransomware payment to ASD within 72 hours	Businesses over A$3 million turnover and critical infrastructure entities
Sector regulators	Additional notifications, for example under APRA CPS 234 or critical infrastructure laws	Regulated entities
ReportCyber	Report the cybercrime; often asked for by insurers and banks	Anyone

Timelines differ by regulator and sector. Check with your lawyer and insurer.

Our view

The first hour should be execution, not improvisation.

The businesses that come through incidents best had three things written down before it happened: who to call, in what order, and who is allowed to make which decisions. Build your first-hour card now and keep it somewhere other than your email.

When we are called, we contain first, preserve evidence second and restore third. We work with your insurer's panel, not around it.

Before it happens

Getting ready for your first hour in five steps.

Step 1Print the card
The steps and numbers, kept off your network.
Step 2Save the numbers
Insurer line, IT provider, bank fraud line, ACSC.
Step 3Agree who decides
Who can disconnect systems, pay, or speak publicly.
Step 4Check backups
Separate from the network, with a tested restore.
Step 5Rehearse
A short walkthrough with leadership each year.

Related guides

Incident response in depth. Before, during and after.

Specific incidents and getting ready.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about the first hour.

What is the first thing to do in a cyber incident?

Stop, then contain without destroying evidence: disconnect affected machines from the network but leave them on, and block sign-in for suspect accounts. Then call your insurer's incident line if you have cover, and your IT provider or the ACSC hotline on 1300 292 371.

Should I turn off a computer I think is compromised?

No. Disconnect it from the network by unplugging the cable or turning off Wi-Fi, and leave it running. Turning it off loses memory that can show how the attacker got in.

Can we just pay the ransom?

Not without legal advice. Paying a sanctioned person or group can be a criminal offence, payment does not guarantee recovery, and businesses with turnover over A$3 million must report any ransomware payment to ASD within 72 hours.

Who do we have to notify?

Your insurer as your policy requires. If personal information may be involved, assess the breach under the Notifiable Data Breaches scheme within 30 days and notify the OAIC and affected people promptly if serious harm is likely. Regulated businesses may have extra obligations to APRA, ASIC or under critical infrastructure laws.

What evidence should we keep?

A timestamped log of everything seen and done, screenshots of ransom notes and suspicious messages, sign-in and mailbox audit logs, and snapshots of affected virtual machines before any rebuild. Don't delete suspicious emails.

What is the ACSC hotline?

1300 CYBER1, which is 1300 292 371. It is free and runs around the clock. Cybercrime can also be reported through ReportCyber on cyber.gov.au.

Next step

Want a response partner on speed dial?

We agree the runbook, contacts and decision rights with you before anything happens, so the first hour is execution. If something is happening now, call us.

Talk to us 07 3114 2808