What actually happens if you get ransomware (and why the boring stuff decides how it ends)
Ransomware rarely arrives with a bang. It arrives as a spreadsheet that won’t open on a Tuesday afternoon. Then a few more files won’t open, and their names end in something odd. Then a message appears on the screen, very politely explaining that your files are locked and how much it will cost to get them back.
The ransom note is the loudest part of the whole thing. It’s also the least important. How the day ends was mostly decided months earlier, by things nobody finds exciting.
If it’s happening right now: take a breath and take a photo of the screen. Unplug that computer’s network cable and turn off its Wi-Fi. Then ring your IT people. If you don’t have any, the Australian Cyber Security Hotline is on 1300 CYBER1 (1300 292 371), 24/7. Come back to the rest later.
What it actually is
Ransomware is malicious software that scrambles your files so you can’t open them, then demands payment, usually in cryptocurrency, for the key. These days the criminals often take a copy of your files first, so they can threaten to publish them as well. Two bites at the same apple.
It rarely gets in through anything clever. A convincing email. A link. A reused password. A computer that’s been putting off its updates.
The first hour
This follows the Australian Signals Directorate’s own guidance. It isn’t dramatic, and that’s the point.
-
Write down what you can see. A photo on your phone of the ransom note and the strange file names is fine. Whoever fixes it will want it, and so will your insurer.
-
Disconnect, don’t destroy. Unplug the affected computer from the network and turn its Wi-Fi off so it can’t spread. Resist the urge to wipe it, reset it or start deleting things. That can destroy exactly what’s needed to recover.
-
Get help. Ring your IT people. If you’re stuck, 1300 CYBER1 can help, any hour.
-
Ring your insurer if you have cyber cover. Many policies have their own steps for this. Better to hear them now than after you’ve done the opposite.
-
Change passwords from a clean device. Email first, then anything with money attached. Turn on two-step sign-in while you’re there.
-
Report it through ReportCyber at cyber.gov.au. It helps warn the next business.
Should we just pay?
It’s tempting. It feels like the quickest way back. The Australian Signals Directorate strongly recommends you don’t. Paying doesn’t guarantee you’ll get your files back, it doesn’t stop your data being sold anyway, and it marks you as someone who pays.
There’s a legal side too. If your business turns over more than $3 million a year and a ransom is paid by you or for you, you must report the payment to the Australian Signals Directorate within 72 hours, under the Cyber Security Act 2024. It’s the payment that triggers it, not the demand.
Who else might need to know?
If personal information was involved, like customer, patient or staff details, the Notifiable Data Breaches scheme may apply. If the Privacy Act covers your business and the breach is likely to cause serious harm, you need to tell the Office of the Australian Information Commissioner and the people affected.
Most businesses under $3 million turnover aren’t covered by the Privacy Act. The big exception surprises people: health service providers, including many medical, dental, allied health and NDIS providers, are covered whatever their size. The OAIC website explains who’s in, or ask your lawyer.
The boring stuff that decides the ending
Here’s the counterintuitive bit. The businesses that recover in a day aren’t the ones with the cleverest software. They’re the ones that did the dull things, quietly, for months beforehand.
-
Backups kept somewhere ransomware can’t reach, and actually tested. Then the ransom note becomes an inconvenience rather than a crisis. See is your backup actually working?
-
Updates. Many attacks get in through holes that already had a fix sitting there.
-
Two-step sign-in, so a stolen password isn’t enough on its own. See multi-factor authentication.
-
Protection that watches behaviour. Shop antivirus looks for threats it already knows, like a bouncer with a list of faces. Behaviour-based protection watches what programs actually do, so when something starts scrambling files it can step in, even if it’s never seen that ransomware before. More in next-gen vs old-style antivirus.
-
Fewer people with the keys to everything. If an everyday account gets caught, it can’t do as much damage.
None of it makes a good story. That’s rather the idea. The best version of this article is the one you read and then didn’t need.
What we do for managed IT clients
Managed IT clients get monitoring, regular updates, ransomware protection that watches behaviour, and encrypted backups kept in Australia, with backup alert emails that come straight to you. Each month there’s a plain-English report of what we fixed or blocked. And if something does go wrong, you ring Kelly or Carisa, with 24/7 support for managed IT clients at no extra charge.
We won’t tell you anything stops every attack. Nothing does, and anyone who says otherwise is selling something. The aim is to make you a dull, difficult target, and to make sure that if something gets through, you can get back on your feet without paying anyone. See cyber security and incident response.
Tell us what’s bugging you.
Wondering how your business would cope? Ring Kelly or Carisa. We’ll talk it through in plain words, including which bits matter and which can wait.
Managed IT clients get 24/7 support at no extra charge. Not a client yet? Call any time. After hours we’ll get back to you as soon as we can, but we can’t promise to start straight away. If it’s urgent and you can’t reach us, ring 1300 CYBER1.
Busy? We'll ring you.
Leave your number and tell us what's not working. We'll take it from there.