Small business security
Ransomware: what a small business should do before and after an attack
Ransomware locks or steals a business’s files and demands payment to get them back or keep them private. It isn’t only a big-company problem. Small businesses are attractive targets because they often have less protection and a strong reason to pay quickly. The good news is that the same few protections stop most attacks.
The short version
If it happens
- Disconnect affected devices from the network, but don’t switch them off or wipe them.
- Call the Cyber Security Hotline on 1300 CYBER1.
- Contact your IT provider and insurer.
- Don’t contact the attackers or pay before getting advice.
How ransomware gets in
Most attacks on small businesses start in ordinary ways:
- Stolen passwords for email, remote access or cloud services, especially without MFA.
- Unpatched systems, particularly internet-facing devices like VPNs, firewalls and remote desktop.
- Phishing emails with malicious attachments or links.
- Exposed remote desktop (RDP) connections left open to the internet.
- Compromised suppliers or IT tools with access to your systems.
Once inside, attackers often spend time finding and deleting backups before encrypting files, and copy data so they can threaten to publish it.
The protections that matter most
| Protection | Why it matters |
|---|---|
| Backups attackers can’t delete | The single biggest factor in recovering without paying. Keep at least one copy offline or immutable, and test restoring. |
| MFA everywhere | Stops stolen passwords being enough to get in. |
| Patching, especially internet-facing devices | Closes the holes attackers scan for. |
| No exposed remote desktop | Use a VPN or secure remote access tool with MFA instead. |
| Limited admin rights | Makes it harder for attackers to spread and disable security tools. |
| An incident plan | Knowing who to call saves hours when it counts. |
These line up with the ASD’s Essential Eight.
A one-page incident plan
Write this down and keep a printed copy, because you may not be able to access your files during an attack.
- Who makes decisions, and who to call first (IT provider, insurer, bank, lawyer).
- Their phone numbers, stored outside your normal systems.
- Where backups are, and who can restore them.
- How you’ll keep operating for a few days without your systems.
- Who will talk to customers and staff.
If you’re attacked
Isolate affected devices
Unplug network cables and turn off Wi-Fi on affected computers. Don’t switch them off or wipe them. Evidence in memory and on disk can help investigators and may help recovery.
Get expert help
Call your IT provider, and the Australian Cyber Security Hotline on 1300 CYBER1 (1300 292 371), which is available 24/7. If you have cyber insurance, notify your insurer straight away. Many policies require you to use their incident response team.
Protect your backups
Disconnect backup drives and check whether cloud backups are intact. Don’t connect backups to infected systems until they’re clean.
Report it
Report the incident through ReportCyber.
Assess what data was affected
If personal information may have been accessed or stolen, you may need to notify affected people and the OAIC. See our guide to notifiable data breaches.
Don’t engage the attackers before getting advice
Responding to ransom demands is a decision for your leadership with expert and legal advice.
Australia’s ransomware payment reporting rule
Since 30 May 2025, businesses with annual turnover above $3 million, and entities responsible for critical infrastructure, must report any ransomware payment made by them or on their behalf to the Australian Signals Directorate within 72 hours. The ASD and Australian Government strongly discourage paying ransoms. Payment doesn’t guarantee you’ll get your data back or that it won’t be leaked.
Recovering
- Rebuild affected systems from clean sources rather than trying to “clean” them.
- Restore data from backups taken before the attack.
- Reset all passwords and revoke sessions, starting with admin and email accounts.
- Fix the way the attackers got in before reconnecting.
- Review what worked and what didn’t, and update your plan.
Practise before it happens
Incident practice in NovaSoft Labs runs your team through fictional incidents, including files that suddenly stop opening. Each choice changes what happens next, and you finish with a debrief.
Common questions
Is it illegal to pay a ransom in Australia?
Paying is not generally illegal, but it may be in some circumstances, such as payments to sanctioned groups. If you’re covered by the reporting rule, a payment must be reported within 72 hours. Get legal advice before making any decision.
We’re tiny. Would anyone really target us?
Many attacks are automated and opportunistic. Attackers look for weak systems, not big names.
Does cloud storage like OneDrive protect us?
It helps, especially version history, but sync can spread encrypted files and attackers with your login can delete data. A separate backup is still important.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.