Updated Guides
Breach remediation
Incident response for Australian organisations.
Containment and triage, root-cause remediation, and support with the Notifiable Data Breaches assessment under the Privacy Act 1988.
Overview
Triage establishes the entry point, the scope and the data touched. The compromise is traced to the code, configuration or infrastructure behind it, the fix is engineered and shipped, and the remediated surface is re-tested.
If you suspect a breach now
If you suspect a breach now, the first-hour steps do not depend on us: isolate affected machines without wiping them, preserve logs, contain accounts from a known-clean device, engage your insurer, and note your notification clock.
Stages of an engagement
Call the incident line or email info@blackshard.com.au to open the engagement.
- Contact and triage: entry point, scope, and data touched, established from what you can tell us
- Containment: actions agreed with you before they are taken, without destroying what root-cause analysis will need
- Root-cause analysis: the compromise traced to the code, configuration or infrastructure behind it, and the adjacent gaps
- Remediation and re-test: the fix engineered and shipped, then the remediated surface re-tested
- Close-out: an incident report for your board, insurer or legal advisers, and Notifiable Data Breaches support
On site in Brisbane, remote Australia-wide
Our head office is at Level 35, Riparian Plaza, 71 Eagle Street, and incident response runs Australia-wide from it. Scoping, containment coordination and the debrief run by phone, video and secure access wherever you operate.
For Brisbane organisations, containment and the debrief can also run in person, at Eagle Street or at your office.
Root-cause remediation, penetration testing, and the Microsoft 365, Azure and Entra ID reviews are delivered by Black Shard, so remediation follows triage without a handover to another vendor.
Ransomware and email account takeover
Ransomware encrypts the file servers and backups it can reach, and has often copied data out before it runs. Containment isolates the affected machines without wiping them, cuts the access the attacker still holds, and establishes which backups are clean before anything is restored.
An email account takeover hands the attacker a mailbox, its forwarding rules and its contacts, and often surfaces as a changed payment instruction. Containment revokes sessions and tokens, removes the rules and app consents the attacker added, and traces what the mailbox sent and read.
Recovery after each
Ransomware recovery restores from backups proven clean, rebuilds what cannot be trusted, and closes the way in before systems return to the network. Whether to pay is a decision for the business and its advisers. Where a payment is made, the Cyber Security Act 2024 requires businesses above the small business turnover threshold to report it to ASD within 72 hours, and the incident report supports it.
After an account takeover the work extends to the other accounts the attacker could reach, the sign-in policies that let the takeover happen, and the people who received mail from the compromised mailbox. Both run through the same cyber attack recovery engagement: containment, the root cause fixed, and the fix verified.
Notifiable Data Breaches support
Where personal information is likely involved, the Privacy Act 1988's Notifiable Data Breaches scheme requires a prompt assessment of whether the breach is likely to result in serious harm, and notification if it is. Black Shard supports that assessment.
Legal advice and the incident report
We do not give legal advice; the legal decision sits with your legal advisers.
The support consists of a factual incident report drawn from the containment and root-cause work, and the changes that make the same assessment faster if it is needed again.
Working with your insurer and panel
Most cyber policies sold in Australia cover incident response costs, and many name a panel of approved forensic and legal firms or require the insurer's consent before a responder is appointed. Call the insurer's incident hotline early: many policies require notice before any external responder is engaged.
The insurer's breach coach, usually a law firm, directs the response from early on. We brief the insurer and the breach coach from the incident report.
Who calls whom, and privilege
Where the policy names a panel, check it before appointing any firm outside it, us included, and get the insurer's consent in writing. Your IT provider works beside us through containment and the fix.
Where privilege over the forensic findings matters, the engagement runs through your lawyers. Australian courts have declined privilege over breach reports commissioned for several purposes, so the engagement letter, the instructions and the reporting lines show the work is done for legal advice, and operational remediation is reported separately.
In the first hour of an incident, the insurer's hotline comes before any external responder, and legal counsel before any forensic engagement.
What the incident report contains
The engagement closes with a written incident report for your board, insurer or legal advisers, drawn from the incident log kept through the response.
- Timeline: what happened and when, in UTC, from first access to containment
- Root cause: the code, configuration or infrastructure the attacker used, and the adjacent gaps
- Data touched: the systems and records reached, and what is still unknown
- Fixes shipped: each change made, and the date it went live
- Re-test: the remediated surface tested again, and the result
The record behind the report
The same report supports the Notifiable Data Breaches assessment, which has to be completed within 30 days of suspecting an eligible data breach, and any ransomware payment report.
An incident log kept in UTC from the first call, outside the affected environment, is part of what belongs in an incident response plan. With one in place before an incident, the report starts from a contemporaneous record.
Incident response retainer
A retainer settles the terms of a response before anything goes wrong. When an incident is declared, the lead, the rates and the access are already agreed, and the work starts on the day without a new engagement.
- A named response lead, who knows your systems, your plan and your insurer before an incident
- A response-time target written into the retainer, set at a level we meet today
- An annual readiness review of the response plan, the contacts and the access a responder would need
- Hourly rates agreed in advance, so no quote waits on the day
The annual readiness review
The readiness review runs the response plan against the systems as they run now, brings the contact list and the insurer's details up to date, and confirms the access path the response lead would use on the day.
Incident readiness without a retainer
Incident readiness is available before an incident: a response plan written for your team and systems, a tabletop exercise that runs the plan against a scenario, and backup and recovery verification by performing a restore.
It is part of a vCISO engagement and is available on its own.
What to compare between retainers
An incident response retainer is worth comparing on the contact path, how its response times are measured, who can authorise containment, the insurer's panel position and how legal privilege is handled.
What does incident response cost?
Incident work is priced on what happened: the systems affected, how far the compromise reached, and whether the engagement stops at containment or extends through root-cause remediation and re-testing.
Mid-incident
If you are mid-incident, email info@blackshard.com.au before scoping it precisely. Containment starts and the detail is filled in as the picture clears.
From the newsroom
Incident response, in the newsroom.
Updated Guides
What belongs in an incident response plan
Questions, answered.
How fast can you start?
Email info@blackshard.com.au. Triage begins on what you can tell us, and containment does not wait for a fully scoped engagement.
What should we do right now if we think we have been compromised?
Isolate affected machines without wiping them, preserve logs and records, contain accounts from a known-clean device, engage your insurer, note your notification clock, and do not negotiate with an attacker alone. Then call the incident line or email info@blackshard.com.au. A suspected incident is enough to begin triage.
Do you give legal advice on our notification obligations?
No. We support the Notifiable Data Breaches assessment with a factual incident report and technical analysis. The legal decision sits with your legal advisers.
Do you fix the underlying flaw as well as containing the incident?
Yes, where that is what you want. Containment stops the immediate damage. Root-cause analysis and remediation fix the code, configuration or infrastructure that allowed it, and the remediated surface is re-tested.
Do you work across Australia?
Yes. Scoping, containment coordination and the debrief run by phone, video and secure access wherever in Australia you operate. Brisbane organisations can have containment and the debrief in person, at Eagle Street or at their own office.
Do we need a retainer to call the incident line?
No. Anyone with a suspected incident can call the incident line or email info@blackshard.com.au. A retainer means the response lead, the rates and the access are settled before that call.
Can you help us get ready before an incident happens?
Yes. Incident readiness produces the response plan, runs a tabletop exercise against a scenario, and verifies backups by performing a restore.
