Ransomware prevention and recovery for Australian businesses

What is ransomware?

Ransomware encrypts files and demands payment for recovery. Cyber extortion can also involve stolen data and a demand to prevent disclosure, with or without encryption.

In the Sophos 2026 global survey of 2,158 ransomware victims, 56 per cent of attacks encrypted data. Among cases involving encrypted data, 66 per cent used backups to recover. These are survey outcomes, not forecasts for an Australian business. They show that having a backup is only part of recovery: it must be clean, available and usable. Sophos State of Ransomware 2026.

Data theft can create an incident even if nothing is encrypted. An attacker may threaten to publish customer records, payroll or intellectual property. Backups restore availability; they cannot retrieve stolen copies. Investigate confidentiality and access alongside the work needed to restart operations.

How attackers get in

In the same Sophos survey, respondents identified malicious email in 26 per cent of incidents, phishing in 24 per cent, compromised credentials in 23 per cent and exploited vulnerabilities in 18 per cent. These are separate reported root causes. Do not treat a global vendor survey as an Australian prevalence figure or assume one entry route explains every incident. Sophos State of Ransomware 2026.

Map the doors into your own environment: mailboxes, remote access, firewall administration, exposed applications, supplier accounts and management tools. Record who owns each service, how it authenticates and how quickly access can be revoked. A protected Microsoft 365 account does not compensate for an unprotected VPN or an abandoned vendor login.

How ransomware spreads through a network

The sequence below is a common investigation pattern, not a mandatory order. A cloud-only business might have no domain controller; stolen SaaS sessions and excessive application permissions may be the main path instead. Watch for unusual use of administrative tools, not just a particular filename. Legitimate remote-management software becomes dangerous when the operator or credentials are compromised.

The initial foothold can let an attacker seek broader access, valuable data and recovery systems. The following stages explain what responders investigate, not a fixed timetable for every incident.

The controls that stop lateral spread are the same ones in the ACSC Essential Eight: application control (stops unauthorised tools running), restricting administrative privileges (limits what a compromised account can do), patching operating systems (closes the exploits used for escalation), and multi-factor authentication (slows credential theft). Network segmentation between office IT and any operational technology adds another barrier. Read more in our Essential Eight guide.

Preventing access and limiting damage

Backups need a different trust boundary from production. Separate backup administration, restrict deletion rights, protect a copy with offline storage or an appropriate immutable retention policy, and rehearse restoration in an isolated environment. Include cloud data, application settings and credentials needed for recovery. A green job report does not prove the business can restart. ASD ransomware recovery guidance.

Reduce the damage a single login can cause. Remove unnecessary local administrator rights, separate privileged accounts from daily work, restrict remote access and retire unsupported exposed systems. Test emergency access and the response process without disabling the protections they are meant to support.

Address these control areas together:

Detecting suspicious activity early

Ransom notes and renamed files are late indicators. Earlier signals include backup deletion attempts, new remote-management tools, unusual privileged logins, disabled security agents and unexpected bulk exports. Correlate endpoint, identity, network and backup activity. Some tools are legitimate in normal administration, so the important evidence is an unusual user, time, destination or volume.

Define who receives the alert, who can isolate a device and how escalation works outside normal hours. Check that responders can still communicate if company email is compromised. Test a phone tree and keep the incident contacts available outside the affected systems.

First 24 hours: containment and reporting

Containment takes priority over a rigid clock. For a managed business network, CISA recommends disconnecting affected hosts or taking affected network segments offline. Power down if network isolation cannot be achieved; doing so loses volatile evidence. ASD public guidance also recommends shutdown to stop spread. Follow your responder-led plan rather than an unconditional rule to always shut down or never shut down. CISA business ransomware response checklist.

Use a clean phone or separate communication channel to coordinate. Name an incident lead, keep a timestamped decision log and preserve available identity, endpoint, firewall and backup logs. Do not wipe devices or reconnect backup storage before responders have agreed the evidence and containment steps. Check safety and service dependencies before isolating clinical, industrial or other critical systems.

Mandatory ransomware payment reporting commenced on 30 May 2025. Captured businesses and relevant critical-infrastructure entities must report within 72 hours of making a payment or becoming aware of one made on their behalf. Home Affairs specifies an AUD 3 million turnover threshold, with special rules for part-year businesses. A demand without a payment does not itself trigger this payment-reporting duty; other incident-reporting duties may still apply. Home Affairs payment-reporting factsheet.

Use this priority sequence without waiting for a particular hour. Review payment-reporting details in our Australian ransomware payment guide.

Recovery: returning to business safely

Build a recovery order around business dependencies: identity and network services, core applications, data, then user access. Restore into a controlled environment from a recovery point validated against the intrusion timeline. Test logins, application transactions, file integrity and integrations before reconnecting users. Record actual restoration times against your agreed recovery objectives.

For organisations covered by the Privacy Act, the NDB scheme requires a prompt assessment of suspected eligible data breaches. Take all reasonable steps to finish that assessment within 30 days. Once there are reasonable grounds to believe an eligible breach occurred, notify the OAIC and affected individuals as soon as practicable. The assessment period is not permission to wait 30 days before notifying. Seek legal advice on your circumstances. OAIC data breach assessment and notification guidance.

Post-incident hardening

Close the entry route before treating the recovery as complete. Revoke compromised sessions and tokens, remove unauthorised application grants, check new accounts and persistence, and rotate affected credentials in a planned order. Keep heightened monitoring after restoration. Assign each finding an owner, due date and evidence of completion rather than purchasing another tool without changing the exposed process.

Common mistakes

Confirm insurer notification requirements and approved response providers before an incident. Policy conditions vary, so do not rely on a generic 24-hour or 72-hour insurance deadline. Likewise, a ransom payment report is not a substitute for notifying customers, regulators or contractual partners where separate obligations apply.