Breach response · Ransomware · Email compromise
Cyber incident response for Perth organisations
We help you contain the damage, find out what happened, recover and meet your reporting obligations.
What should a business do in the first hour of a cyber incident?
Isolate affected devices from the network but leave them on, do not pay a ransom or contact the attacker, change critical passwords from a clean device, write down what you noticed and when, and call your incident responder and cyber insurer. Preserving evidence is essential for insurance, legal notification and finding the root cause.
When something has gone wrong
It might be a compromised mailbox sending fake invoices, ransomware on a file server, or a website leaking customer details. Whatever it is, what you do in the first few hours makes a big difference.
We help you contain the damage, find out what happened, recover safely and meet your reporting obligations, working alongside your IT provider, insurer and lawyers where they are involved.
Active incident? Call 1300 566 652 now. Disconnect affected devices from the network but leave them powered on, do not pay a ransom, and do not wipe anything yet. You can also report to the Australian Signals Directorate on 1300 CYBER1 (1300 292 371).
// How we respond
Our incident response process
- 01
Triage
A quick call to understand what is happening, which systems are involved and what is at stake.
- 02
Contain
Isolate affected systems, revoke compromised credentials and stop further spread without destroying evidence.
- 03
Investigate
Establish how the attacker got in, what they touched and whether personal or confidential data was accessed.
- 04
Eradicate and recover
Remove the attacker, close the entry point and restore from verified clean backups.
- 05
Notify and report
Support with OAIC notification, ASD reporting, insurer requirements and client communication.
- 06
Learn
A post-incident review with practical fixes so it does not happen again.
// Know your obligations
Who you may need to tell, and when
| Obligation | Who it applies to | What to do |
|---|---|---|
| Notifiable Data Breaches scheme | Organisations covered by the Privacy Act (generally turnover over $3 million, plus health service providers and some others) | Assess a suspected breach within 30 days; notify the OAIC and affected individuals if serious harm is likely |
| Ransomware payment reporting | Businesses with annual turnover over $3 million, and critical infrastructure entities | Report any ransomware or extortion payment to the Australian Signals Directorate within 72 hours |
| Insurer notification | Organisations with cyber insurance | Notify early through the insurer incident line; many policies require approved responders |
| Cybercrime report | Everyone | Report through ReportCyber at cyber.gov.au; individuals with stolen identity details can contact IDCARE on 1800 595 160 |
This is general information, not legal advice. Obligations depend on your organisation and the incident; we help you work through them with your lawyers.
// Be ready
Get prepared before you need us
Incident response plan
A short plan: who decides, who calls whom, where backups live and how to reach your insurer, IT provider and lawyer.
Tabletop exercise
A 90-minute walk-through of a realistic scenario with your leadership team to find the gaps before a real incident does.
Backup restore test
We check your backups restore, and time how long it takes.
// FAQ
Common questions
We think we have been breached. What do we do first?
Disconnect affected devices from the network but leave them powered on, do not pay any ransom or reply to the attacker, change critical passwords from a clean device, and call 1300 566 652. Write down what you noticed and when. Preserving evidence matters for insurance, notification and finding the root cause.
Should we pay a ransom?
The Australian Government advises against paying. Payment does not guarantee your data back or that it will not be leaked, and it marks you as a willing payer. If your business turnover is over $3 million and a ransom is paid, it must be reported to the Australian Signals Directorate within 72 hours.
Do we need to notify the OAIC?
If you are covered by the Privacy Act and an eligible data breach is likely to cause serious harm to individuals, you must notify the OAIC and the affected people. Suspected breaches must be assessed within 30 days. We help you establish the facts quickly so you can decide properly.
Can you work with our insurer and IT provider?
Yes. If you have cyber insurance, call your insurer's incident line early, because many policies require their approved responders. We work alongside insurer panels, lawyers and your IT provider.
Can you help us prepare before anything happens?
Yes, and it is far cheaper. We write a short, practical incident response plan, run a tabletop exercise with your team, and make sure backups, logging and contact lists are ready.
// Keep going
Related services
Hacked Website Repair
Hacked website? We investigate, remove malware and backdoors, close the entry point and harden WordPress, Joomla and custom sites. Perth, since 2008.
Cyber Insurance Readiness
Get your cyber insurance questionnaire right. We verify MFA, backups, patching and email security, close gaps before renewal and document the evidence.
Cyber Security Consulting
Independent cyber security consulting in Perth: risk assessments, Essential Eight, Privacy Act, incident readiness and board reporting. From $1,500.
// Next step
Talk to us about Cyber Incident Response
Tell us what you run and what you are worried about. We will come back within one business day and, if it helps, send you a fixed-price quote.
- No-obligation first consult
- Fixed scope and price before work starts
- A clear written report and next steps
Written and reviewed by Noah Greenstone, Founder and Principal Consultant. Last reviewed 22 October 2026.
Tell us what is going on
We read every enquiry and reply within one business day. If it is urgent, call 1300 566 652.
Organisations Noah and the team have built, secured and supported
