Experienced a breach?

Under attack? Call us now.

24/7 incident line

1800 370 270

Call first, then work through the five first-hour steps.

Call now First-hour steps

Other ways to reach us

Report to ASD's ACSC: 1300 CYBER1 (1300 292 371)
After the call: Brief the incident

The first hour

Five steps that preserve evidence and shorten the response

Isolate affected machines
Disconnect affected machines from the network: pull the cable, drop the Wi-Fi, pause the VM. Do not wipe, reinstall or clean up. Responders need that evidence to establish how access happened and confirm it is closed.
Preserve what you can
Keep logs, screenshots, ransom notes, odd emails, anything that looks wrong. Note times as you go: a plain timeline of what you saw and when is the most useful document you can hand a responder.
Contain accounts
From a known-clean device, revoke active sessions for accounts you know are affected and record what you see. Hold password resets until the responder has scoped the intrusion, then rotate admin and email credentials together. Make none of these changes from a machine that may be compromised.
Engage your insurer
Cyber policies often require notification before action is taken. Do not pay, reply or negotiate without help, and get advice before communicating with an attacker in any form.
Know your notification clock
If personal information is likely involved, the Privacy Act's Notifiable Data Breaches scheme may apply, and the assessment it requires has to be prompt. We support that assessment. We do not give legal advice.
Call at any point1800 370 270Call even if you are not sure it is an incident.

Breach remediation

Containment, root cause and remediation, handled end to end

We investigate the affected systems, work with your team on containment, fix the weakness behind the incident and verify the fix, reporting to you in writing at each stage.

Breach remediation

Report: Security events by hour: what our monitoring sees

Containment and triage
The entry point, the scope and the data touched, in writing, with containment actions agreed with you before they are taken.
Root cause and remediation
The application, infrastructure or configuration weakness behind the incident, traced, fixed and deployed, with adjacent gaps hardened.
Verification
A re-test of the affected surface after remediation to confirm the holes are closed.
The incident report
A report for your board, insurer or legal advisers, including support for a Notifiable Data Breaches assessment.

Advisories